Data flight in Novo Nordisk exposes patients and professionals: why pseudonymization is not yet sufficient for clinical safety

Novo Nordisk, the Danish pharmacist known to be the world's largest insulin producer and for LPG-1 medicines such as Wegovy and Ozempic, confirmed an unauthorized access to their internal systems that involved the external copy of data concerning patients in some clinical trials and health professionals. Although the company claims that patient data were pseudonymic and did not contain direct name identifiers, the leak poses real risks which go beyond the initial headline and which deserve serious analysis from both the security and the privacy and scientific integrity perspective.

The pseudonymization reduces the immediate risk of identification, but does not eliminate it: data such as year of birth, sex, biomarkers, history of immunogenicity and lifestyle factors can be combined with other legitimate or filtered sources to attempt reidentification. Biomedical data sets are particularly sensitive because they contain unique features that facilitate correlation with external bases something that has already happened in academic research and in previous security incidents.

In addition to patients, names, registration numbers, phones, postcards, WhatsApp details and health professionals' office locations have been exposed. That makes these people targets of phishing, vishing and directed suplantations (speed-phishing), tactics that usually result in the theft of credentials, fraud or side movements to critical infrastructure if weaknesses are used in network authentication or segmentation.

From a regulatory point of view, in the European Economic Area such incidents are active strict obligations: notification to data protection authorities in short time and, most likely, communication to interested parties if there is a risk to their rights and freedoms. The lack of transparency about when intrusion was detected or how many people were affected complicates the assessment of legal compliance and increases the reputational risk for the company.

For patients and trial participants, the practical recommendation is to request clear information from the sponsor or the responsible researcher: what specific data have been shared, what mitigation measures are offered (e.g. identity monitoring services) and how follow-up will be managed. Monitoring unusual financial movements, suspicious mail and communications requesting data or payments is essential and any message that requests to verify information must be confirmed through independent official channels.

The health professionals concerned should raise the alert of unexpected contact attempts, check the mail and message sender before responding, avoid providing credentials through unsafe channels and consider notifying their employers or the health regulatory entity if they detect fraud attempts. Enable multi-factor authentication, review recent access to professional accounts and maintain caution against out-of-the-box applications are immediate and effective measures.

For pharmaceutical and clinical research organizations, the case highlights the need to strengthen technical and organizational controls: applying pseudonymization with secure key management, restricting access with minimum privilege principles, segmenting networks, deploying effective EDR and IMS and conducting attack simulation tests to validate detection and response. Incident response planning should include transparent communication with regulators and patients, independent forensic analysis and verifiable mediation measures.

It should also be recalled that safety is a chain: suppliers and research partners must be subject to strict audits and contractual requirements to prevent a failure in third parties from presenting sensitive data. Investing in regular audits, staff training and data leakage table-top exercises reduces the likelihood of replicating similar incidents.

No measure is infallible, but there are public resources that help respond and prevent attacks focused on deception and the theft of credentials, for example, the US Infrastructure and Cybersecurity Agency. USA (CISA) provides practical guidance on phishing and its prevention https: / / www.cisa.gov / phishing and European legislation on data protection and reporting obligations can be consulted in guides such as those of GDPR.eu https: / / gdpr.eu /. Novo Nordisk's own note with the incident update is publicly available and must be read to know the official position https: / / www.novonordisk.com / news-and-media / latest-news / incident-update.html.

In summary, this incident recalls that the protection of clinical information is both an ethical and legal requirement and a complex technical task. The pseudonymization reduces risks but does not eliminate them, and the exposure of professional contacts opens the door to targeted attacks that can amplify damage. Patients, health care and companies should require transparency, implement immediate mitigation measures and review their controls so that confidence in clinical research and health care is not eroded by avoidable failures.