A cyber-extortion group calling itself FulcrumSec said on Monday that it had stolen roughly 1.3 terabytes of data from Novo Nordisk, the Danish maker of the weight-loss drugs Wegovy and Ozempic, and had demanded $25 million to keep it private. Novo Nordisk did not pay. The group, by its own account, is now looking for buyers.
The numbers in a breach like this are easy to recite and hard to feel. A terabyte and a third is a lot of files; the more telling figure is time. FulcrumSec claims it spent more than two months inside the company’s networks before anyone moved it out, which is the part of the story that should worry a board more than the ransom note. Two months is not a smash-and-grab.
What the group says it took reads like an index of everything a pharmaceutical company would least like to lose: source code, proprietary information on drugs both released and unreleased, clinical-trial data, records on employees, doctors and patients, details of manufacturing facilities, and material the group described as relating to the company’s internal AI models.
The breadth is the point. This was not a single database left exposed but, on FulcrumSec’s telling, a long walk through the building.
