← Novo Nordisk

2026 Novo Nordisk — FulcrumSec stage-2 HuggingFace dump; dual extortion after unpaid demands (unverified scope)

2026 Unknown records affected Share on X

Data compromised

FulcrumSec stage 1: compounds/manufacturing recipes/source code per June leaks; stage 2 (Aug 12): actor claims complete HuggingFace AI/ML ecosystem — 30 models, 70 datasets, ~0.5 TB Cell Painting microscopy images (~1.05 TB torrent). TheUSERS007 separate $50M IP claim unconfirmed. Distinct from company-confirmed June 11 pseudonymized clinical-trial subset.

Technical writeup

Unverified extortion overlay with August 2026 expansion — Novo Nordisk disclosed a June 11 IT security incident with limited pseudonymized clinical-trial data copied (novo-nordisk-clinical-trial2026). FulcrumSec demanded $25M and leaked after non-payment (June); TheUSERS007 separately demanded $50M for claimed IP (June). On August 12, 2026 DataBreaches.net reported FulcrumSec’s “stage 2” release of Novo’s HuggingFace AI/ML ecosystem (30 models, 70 datasets, ~1.05 TB including proprietary Cell Painting microscopy images) via torrent, framing stage 1 as compounds/manufacturing recipes/source code. Novo’s last public update remained June 18 at indexing; company had not confirmed stage-2 scope or additional patient notifications. recordsAffected stays 0 pending attested individual counts beyond the confirmed clinical-trial subset.

Root cause

Separate FulcrumSec ($25M) and TheUSERS007 ($50M) extortion campaigns after June 11 company IT incident; both groups leaked data when unpaid

References