Novo Nordisk Breach Exposes Clinical Trial and Healthcare Professional Data

Novo Nordisk disclosed a cyberattack in which attackers accessed a limited number of internal IT systems and copied non-public data tied to some clinical trial participants and healthcare professionals. The stolen clinical trial information included pseudonymized patient identifiers rather than direct identifiers such as names, but it still covered sensitive fields including trial participation details, sex or gender, year of birth, biomarkers, health or immunogenicity data, and lifestyle factors such as smoking status, alcohol use, and BMI.

The company said healthcare professional contact and registration details were also exposed, raising the risk of targeted phishing and impersonation attempts over email, phone, and WhatsApp. Novo Nordisk took affected internal systems offline as a precaution, brought in external cybersecurity experts to investigate, and said core business operations were not impacted, while the total number of affected individuals and the full scope of the breach remain under investigation.