Novo Nordisk has disclosed a cybersecurity incident in which attackers gained unauthorized access to internal systems and copied non-public data externally. The compromised information includes clinical trial patient data and records belonging to healthcare providers. The breach was discovered on 11 June 2026. The company has not disclosed how many individuals are affected.
The disclosure was first reported by Eduard Kovacs at SecurityWeek and subsequently confirmed by The HIPAA Journal and BankInfoSecurity. Novo Nordisk told patients enrolled in affected clinical trials to remain vigilant, according to Fierce Pharma. Core business operations, including manufacturing and supply of Ozempic and Wegovy, are unaffected.
What Was Taken and What Was Not
The company confirmed that non-public data was copied without authorization but has not specified the volume or the precise categories of clinical trial records involved. Healthcare provider information was also among the exfiltrated data, according to reporting by The HIPAA Journal and BankInfoSecurity.
No CVEs have been disclosed. Novo Nordisk has not identified the attack vector, the duration of access prior to discovery or whether the breach was the work of a ransomware group, a data extortion actor or something else entirely. That silence is a problem. Clinical trial participants whose data has been copied cannot assess their exposure without knowing what specific records were taken and by whom.
The affected products named in the disclosure, Ozempic and Wegovy are not software platforms. Their appearance in Novo Nordisk’s statement reflects the clinical programmes under which patient data was held, not a flaw in the drugs themselves.
Clinical Trial Data Carries Specific Regulatory Exposure
Pharmaceutical clinical trial records sit at the intersection of GDPR, national health data law and sector-specific research ethics regulation. In Denmark, Novo Nordisk’s home jurisdiction, the Danish Data Protection Act supplements GDPR with stricter provisions governing health data processing. Datatilsynet, Denmark’s data protection authority, will be among the regulators assessing whether the company’s technical and organizational measures met the standard required for this category of data.
Under GDPR Article 33, Novo Nordisk was required to notify Datatilsynet within 72 hours of becoming aware of the breach. The company has confirmed it is taking regulatory response measures but has not publicly confirmed the notification was submitted within that window. Datatilsynet has not yet issued a public statement on the incident.
For clinical trial participants specifically, the data involved is among the most sensitive a pharmaceutical company holds diagnoses, treatment responses, adverse events and informed consent records. The HIPAA Journal notes that healthcare professional data was also taken which raises separate questions about professional contact details being used in targeted phishing or impersonation campaigns.
The Disclosure Leaves More Questions Than It Answers
Novo Nordisk has declined to name the number of affected individuals. That is their legal right under certain interpretations of breach notification law but it is not a position that holds up well against GDPR’s transparency principle when the data involved is special category health information. The company’s statement that operations remain unaffected is accurate but beside the point. The people at risk here are not shareholders watching production lines, they are patients who volunteered for clinical trials and whose medical records have left the building.
No attack vector, no actor identification, no timeline of the intrusion and no figure for affected individuals. For a breach of this sensitivity, that level of disclosure is thin. Affected parties are being asked to remain vigilant without being given the information they need to know what they are watching for.
If You Were a Novo Nordisk Clinical Trial Participant
Watch for contact from anyone claiming to be a Novo Nordisk researcher, clinician or patient support representative. The stolen data contains enough detail to make impersonation attempts convincing. Do not provide additional personal or medical information in response to unsolicited outreach, regardless of how official it appears.
If you received a notification letter from Novo Nordisk, retain it. It establishes that you were identified as affected which matters if you subsequently experience fraud or identity misuse linked to this breach.
Healthcare providers whose records were included should audit any third-party access credentials associated with Novo Nordisk’s clinical systems and treat any incoming communications referencing the breach as a potential pretext for credential harvesting.
References
- Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems
- Pharmaceutical Giant Novo Nordisk Discloses Security Breach
- Clinical Trial Data Stolen in Novo Nordisk Cyberattack
- Ozempic Drug Maker Loses Clinical Trial Data in Hack
- Novo Reports Data Breach, Tells Clinical Trial Patients to Remain Vigilant
- Novo Nordisk Hit By Cyberattack; Non-Public Data Copied But Operations Continue
This post is also available in:
Svenska
