Novo Nordisk Faces a $25 Million Ransom Gambit as Expansion Plans Gain Momentum

Novo Nordisk battles a massive data breach by FulcrumSec while advancing Wegovy; stock rises 3% but remains 42% down year-to-date.

The Danish pharma giant Novo Nordisk is navigating a treacherous dual crisis: a sophisticated cyberattack that exposed 1.3 terabytes of sensitive data, while simultaneously racing to bring its blockbuster weight-loss pill Wegovy to new markets. The group behind the breach, FulcrumSec, is demanding $25 million — and the company has refused to pay.

The stock, however, has shrugged off the security headache. Shares climbed roughly 3% on Wednesday to €38.74, extending a recovery that has seen the equity rebound 28% from its March low. That marks a stark contrast with the broader year?to?date picture: the stock is still nursing a 42% decline, and at Tuesday’s close of €37.59 it traded well below its 200?day moving average of €41.34 and more than 42% below its annual peak.

A Backdoor Opened by a GitHub Token

FulcrumSec, which surfaced only in late 2025, specializes in breaching corporate cloud databases hosted on Amazon Web Services or Microsoft Azure. The attack on Novo Nordisk began months ago, when the hackers exploited a GitHub access token to infiltrate the company’s IT infrastructure. Once inside, they systematically harvested credentials and continued copying data even after the intrusion was detected.

The haul is vast and damaging. According to the cybercriminals, it includes source code, internal AI models — including a secret project codenamed “Dragonfly” — details of both marketed and experimental drugs, clinical trial data, production?facility information, and personal records of employees and doctors. The company confirmed the breach on 11 June, immediately taking internal systems offline and gradually restoring them.

Patient data is a particularly sensitive component. FulcrumSec claims to hold pseudonymised profiles of roughly 11,500 study participants, including patient IDs, birth years, and health information. Novo Nordisk says names were not exposed, but the psychological and regulatory fallout could be severe under Europe’s General Data Protection Regulation. If negligence is proven, fines could reach 4% of annual revenue.

A Perverted “Safety Net” and a Sale Threat

The hackers have adopted a cynical strategy: they have held back a portion of the data — including the patient information — claiming this is a “damage?limitation” measure. In reality, it is a pressure tactic. Since Novo Nordisk refused to pay, FulcrumSec is now threatening to sell 700,000 individual files to private buyers. So far the company has not appeared on the group’s public leak site, but the clock is ticking.

Thomas Willkan, head of research at cybersecurity firm Lab?1, rates FulcrumSec’s capabilities as “absolutely credible”. The group’s modus operandi — breaking into cloud environments, exfiltrating data, and then demanding hush money — makes them a formidable adversary. Novo Nordisk is now conducting a forensic investigation with external experts while bracing for potential regulatory action once authorities assess the severity of the clinical?data leak.

Pushing Ahead with Oral Wegovy in China and Europe

Amid the cybersecurity storm, Novo Nordisk is pressing forward aggressively with its commercial expansion. CEO Mike Doustdar announced in Beijing that the company expects imminent Chinese approval for the oral version of Wegovy. The move is a direct challenge to rival Eli Lilly in the world’s second?largest pharma market. Novo Nordisk holds data exclusivity for semaglutide in China until early 2027, giving it a temporary competitive edge.

In Europe, the UK’s Medicines and Healthcare products Regulatory Agency granted marketing authorisation for the Wegovy pill on Tuesday. To meet surging demand, Novo Nordisk is pouring $6.5 billion into US manufacturing facilities that already operate around the clock. The US Food and Drug Administration recently declared that supply shortages of both Wegovy and injectable Ozempic have ended.

Balancing Operational Risks Against Strategic Gains

Investors are now weighing these operational and strategic advances against the considerable risks posed by the data breach. A full leak of internal documents could erode trust among patients, doctors, and regulators precisely when Novo Nordisk is trying to scale its presence in China and satisfy global demand for its GLP?1 therapies. The company is also grappling with production bottlenecks for its existing products.

For now, the resolution of the cyber extortion remains uncertain. FulcrumSec has not yet published the stolen files, and Novo Nordisk shows no sign of capitulating. The stock’s recent bounce suggests the market is focusing on the growth narrative rather than the security scandal, but the RSI currently points to neutral momentum — reflecting the deep uncertainty that hangs over the pharma giant.