FulcrumSec Spent 2 Months Inside Novo Nordisk Networks Before $25M Demand

For cybersecurity professionals, the FulcrumSec breach of Novo Nordisk is a case study in modern cyber extortion: a two-month dwell time, the theft of over a terabyte of data, and a demand for $25 million. The group’s decision to withhold certain sensitive data under a harm-reduction policy adds a nuanced layer to the typical ransomware playbook, signaling a shift in extortionists’ public relations strategies. Lab-1’s Thomas Willkan confirmed FulcrumSec’s track record is credible, making this an incident to study for TTPs.

A cyber extortion group known as FulcrumSec has publicly claimed to have stolen more than a terabyte of data from pharmaceutical giant Novo Nordisk, demanding $25 million in ransom. The group, which first appeared in October 2025 and has been described by security researchers as credible in both capabilities and claims, says it spent over two months inside Novo Nordisk’s networks exfiltrating a broad range of sensitive information. The stolen data reportedly includes company source code, proprietary details on released and unreleased drugs, clinical trial data, personal information on employees, physicians, and roughly 11,500 pseudonymised patients, as well as information about production facilities and internal AI models. After Novo Nordisk refused to pay, FulcrumSec said it is exploring private sales of certain drug-related data and may open-source the remainder as a deterrent tactic.

“

For cybersecurity professionals, the FulcrumSec breach of Novo Nordisk is a case study in modern cyber extortion: a two-month dwell time, the theft of over a terabyte of data, and a demand for $25 million.

The incident first came to light when Novo Nordisk disclosed a cybersecurity breach on June 11 that it characterized as unauthorized access to a limited number of internal IT systems involving some personal data. FulcrumSec, however, paints a far more extensive picture. In a message posted on its site on June 16 and in subsequent email exchanges with Reuters, the group detailed a timeline that suggests initial contact was made with unnamed executives around June 1, with the company responding two days later via a Proton Mail address for verification. Novo Nordisk confirmed to Reuters that it is aware of the published claims and is coordinating with authorities, but would not comment further on the scale of the breach.

The implications for Novo Nordisk are severe. The company, best known for its blockbuster obesity and diabetes treatments, faces not only potential regulatory penalties under GDPR and other data protection laws but also the risk that proprietary research could fall into competitors’ hands. While FulcrumSec says it will withhold employee, physician, and patient data as part of a “harm-reduction strategy,” the release or sale of drug-related intellectual property could undermine years of R&D investment. Thomas Willkan, head of research at cybersecurity firm Lab-1, who has tracked FulcrumSec closely, noted that the group’s claims are usually legitimate, adding credibility to the threat.

From a broader sector perspective, this incident underscores the growing targeting of pharmaceutical companies by sophisticated cyber extortion groups. The stolen data categories—ranging from unreleased drug information to internal AI models—reflect an understanding of which assets hold the most value, both for ransom leverage and for potential resale. The two-month dwell time indicates careful planning and a high degree of network penetration, likely evading detection while systematically mapping and exfiltrating data. FulcrumSec’s public stance on harm reduction is a notable evolution in extortion tactics; by selectively withholding certain data, the group seeks to differentiate itself and possibly apply moral pressure while still maximizing profitability.