Two Hacker Groups, One Target: Novo Nordisk Rejects $75M in Ransom Demands as Shares Climb
Published on 06/25/2026 at 20:11 | Redaktion boerse-global.de
Novo Nordisk shares have snapped back nearly 12% in the past week, pushing the relative strength index to just shy of 71 — a level that often hints at a technical overheat. Yet the rally has unfolded against one of the most serious data-security breaches in the pharmaceutical industry. Two separate hacker groups claim to have spent more than two months inside the Danish drugmaker’s network, copying 1.3 terabytes of files that include everything from clinical-trial data to the secrets of its next-generation obesity pipeline.
The groups operating under the handles FulcrumSec and TheUSERS007 each delivered their own ransom note. FulcrumSec demanded $25 million; TheUSERS007 asked for $50 million. Novo Nordisk paid neither. After the refusal, FulcrumSec announced it would sell the stolen data privately on the dark web.
The attackers gained initial entry through a GitHub access token discovered in March, according to the group’s own claims. From there they cloned internal repositories and extracted additional credentials, eventually obtaining more than 700,000 files. The haul includes source code, details on both marketed and unapproved drugs, internal AI models, and information on roughly 11,500 pseudonymised clinical-trial participants. Patient IDs, study enrolment data, birth years, biomarkers, and lifestyle information were all exposed, though the company stresses that direct identification would require supplementary data.
The picture for healthcare professionals is more blunt. Their files contained names, registration numbers, email addresses, telephone numbers, and office locations. Novo Nordisk is now warning employees, investigators, and doctors to be on guard against targeted phishing attempts via email, phone, and WhatsApp.
Should investors sell immediately? Or is it worth buying Novo Nordisk?
Perhaps the most sensitive loss involves the company’s metabolic pipeline. FulcrumSec claims it has information on the experimental weight-loss agents Amycretin and CagriSema, as well as five development programmes that have never been publicly disclosed. With Eli Lilly intensifying competition in the weight-management and cardiometabolic space, the theft of intellectual property represents a real – if unquantified – risk.
Novo Nordisk’s response has been swift. It took affected internal systems offline, brought in external cybersecurity specialists, and notified the relevant authorities. The company insists that core business operations continue without disruption. Still, the incident could trigger formal investigations from data-privacy regulators in key markets, along with potential fines and mandates for costly security upgrades. The full financial and reputational toll will not be clear for months.
On the other side of the ledger, the company has kept its share-buyback engine running. A programme launched on 4 February 2026 authorises repurchases of up to 15 billion Danish kroner over twelve months. By 19 June, Novo Nordisk had bought back roughly 21 million B-shares at an average price of around 266 kroner, spending about 5.6 billion kroner. The current sub-programme, which began on 6 May 2026, runs until February 2027 and accounts for some 11.2 billion kroner of that total. In the week ending 19 June alone, the group picked up just over 1 million B-shares.
Novo Nordisk at a turning point? This analysis reveals what investors need to know now.
The buyback has provided a structural floor under the stock, which currently trades near 42 euros. That is roughly 38% above the March low of 30.25 euros, but still about 32% below the 12-month high of 61.20 euros. The broader market backdrop has also shifted slightly in Novo Nordisk’s favour: its oral Wegovy formulation has received approval in the United Arab Emirates, paving the way for the first launches of the pill outside the United States.
Investors will get their next detailed update on 5 August, when Novo Nordisk releases its second-quarter results. The earnings call will almost certainly be dominated by questions about the data breach – which data actually leaked, whether any patients or partners are threatening legal action, and what additional safeguards are being installed. For now, the shares are riding a combination of buyback support, technical momentum, and hope that the pipeline remains intact. But the cyberattack hangs over every one of those pillars.
Ad
Novo Nordisk Stock: New Analysis - 25 June
Fresh Novo Nordisk information released. What's the impact for investors? Our latest independent report examines recent figures and market trends.
Disclaimer regarding our articles: No investment advice, no buy or sell recommendation. Information on prices, companies, and markets is provided without guarantee; changes are possible at any time. Stock market transactions can lead to substantial losses. Our articles are created and reviewed in whole or in part automatically with the support of AI.
