People search Novo Nordisk data breach timeline because regulated data and trust are existential—one incident triggers class actions and regulator exams. BreachHistory indexes 2 Novo Nordisk-linked incidents. This page maps every attested event through 2026 with internal links to canonical records.
Why Novo Nordisk breach history matters
Novo Nordisk operates in Healthcare (Denmark). Across indexed rows, recurring themes include ransomware and extortion, unverified actor or scraping claims. Understanding the chronological pattern helps security teams, customers, and regulators separate confirmed disclosures from forum marketing.
Full timeline through 2026
2026 — FulcrumSec and TheUSERS007 dual extortion; IP/clinical data leaked after unpaid demands (unverified scope)
Unverified claim — treat actor counts cautiously. Unverified extortion overlay — June 2026. Novo Nordisk separately disclosed a June 11 IT security incident with limited pseudonymized clinical-trial data copied (indexed as novo-nordisk-clinical-trial2026). DataBreaches.net reported that two independent threat actors later claimed additional thefts: FulcrumSec demanded $25 million and leaked data after non-payment (June 15 scoop), while TheUSERS007 demanded $50 million for a separate claimed dataset including intellectual property (June 16). When Novo Nordisk did n Exposed categories include FulcrumSec: sensitive internal documents and clinical-trial data per DataBreaches reporting after $25M demand rejected; TheUSERS007: separate claimed IP theft with $50M demand—Novo. No attested victim count is published for this row yet. See the novo-nordisk-extortion 2026 record and canonical BreachHistory entry.
2026 — IT security incident; clinical trial patient data copied (investigation ongoing)
Cataloged incident. On June 11, 2026 Novo Nordisk A/S published an official incident update stating it identified an IT security incident involving unauthorized access to a limited number of internal IT systems, with certain non-public data—including personal data—copied externally without authorization. The Danish drugmaker (maker of Wegovy and Ozempic) said the exposure affected a limited amount of information related to patients participating in some clinical trials; potential fields include pseudonymized patient IDs, sex, year of Exposed categories include Pseudonymized clinical-trial patient data per company notice: patient IDs, trial participation, sex, year of birth, biomarkers, health/immunogenicity data, lifestyle factors (BMI, . No attested victim count is published for this row yet. See the novo-nordisk-clinical-trial 2026 record and canonical BreachHistory entry.
Patterns and analysis
- Ransomware and extortion — appears across multiple Novo Nordisk catalog entries; prioritize controls that address this class of failure.
- Unverified actor or scraping claims — appears across multiple Novo Nordisk catalog entries; prioritize controls that address this class of failure.
- Record-count hygiene — BreachHistory indexes actor-cited figures separately from company-confirmed totals; read each row's technicalWriteup before treating counts as fact.
- 2026 monitoring — New disclosures roll into this timeline as they are verified or labeled unverified per catalog policy.
What to do if you may be affected
- Step 1: Enable phishing-resistant MFA on every account tied to this brand.
- Step 2: Use unique passwords and a password manager—breach rows often involve credential reuse.
- Step 3: Monitor official company breach notices and regulator filings, not dark-web downloads.
- Step 4: Watch for medical-ID theft and billing fraud after health-data incidents.
- Step 5: Bookmark the Novo Nordisk company page for new 2026+ disclosures.
Canonical BreachHistory hub
Explore every indexed row: breachhistory.com/novo-nordisk · Latest: novo-nordisk-extortion2026.
Sources: BreachHistory catalog (2 rows for Novo Nordisk), company and regulator disclosures cited in individual breach records.