Danish pharmaceutical giant Novo Nordisk has disclosed an IT security incident that resulted in unauthorized access to a limited number of its internal systems, including data related to some clinical trial participants. The company stated that certain non-public information was copied externally without authorization and that an investigation is currently underway.
According to Novo Nordisk, the affected information involves a limited amount of data from patients participating in selected clinical studies. The exposed records may include patient identification codes, year of birth, sex, biomarkers, health and immunogenicity information, and lifestyle-related factors such as smoking status, alcohol consumption, and body mass index (BMI). However, the company emphasized that names and other direct personal identifiers were not compromised.
The company noted that the data was pseudonymized, meaning that additional information not involved in the breach would be required to identify individual trial participants. As a result, Novo Nordisk does not believe the incident presents any immediate risk to patients. Nevertheless, it has advised affected individuals to remain vigilant and report any unusual activity that could be linked to the event.
Following the discovery of the breach, Novo Nordisk engaged external cybersecurity experts and notified relevant authorities. As part of its response, several internal IT systems were temporarily taken offline to protect the company's digital environment while remediation efforts continue. The company stated that its core business operations, including manufacturing and commercial activities, remain unaffected.
"Protecting the security and integrity of our systems, including personal data of employees, customers, patients, and stakeholders, remains our highest priority," the company said in its public update.
The investigation remains ongoing, and Novo Nordisk has indicated that it will continue to inform impacted parties as more information becomes available.
