The cyberattack on Novo Nordisk has become much more than another healthcare data breach. What began as unauthorized access appears to have evolved into a case study in how cybercriminals are changing their targets. Rather than focusing solely on patient records or operational disruption, the attackers allegedly stole clinical trial data, proprietary drug research, artificial intelligence models, and intellectual property before leaking portions of the information after a reported $25 million ransom demand was refused. If those claims hold up, the incident represents a shift in what healthcare organizations must defend and in the assets attackers find most lucrative.
The broader healthcare sector has already been struggling to contain cyber risk. According to HIPAA Journal, 772 healthcare data breaches affecting 500 or more individuals were reported in 2025, exposing information belonging to approximately 139.7 million people. At the same time, healthcare organizations are rapidly expanding their use of artificial intelligence, cloud platforms, connected medical devices, and specialized third-party technology vendors. Each new capability improves care delivery and operational efficiency, but it also expands the attack surface.
The Novo Nordisk incident highlights a larger reality. Healthcare cybersecurity is no longer just about protecting electronic health records. It is increasingly about protecting the research, algorithms, clinical data, and intellectual property that drive the next generation of medicine.
Healthcare’s most valuable assets have changed
For years, healthcare cybersecurity strategies were largely built around safeguarding protected health information and maintaining clinical operations. Those priorities remain essential, but today’s healthcare organizations possess a different class of assets that may be even more attractive to sophisticated threat actors.
Clinical trial data, proprietary molecule libraries, AI training datasets, genomic research, manufacturing processes, regulatory documentation, and drug discovery pipelines represent years of scientific investment and billions of dollars in research and development. Unlike stolen financial information, these assets cannot simply be reissued or replaced.
Reports surrounding the Novo Nordisk incident suggest attackers were interested in much more than personal information. They allegedly sought access to confidential research programs, proprietary compound structures, AI models, and information related to future therapies. While many of these claims have not been independently verified, the incident illustrates how pharmaceutical innovation itself has become a strategic cyber target.
This evolution changes how healthcare executives should think about cybersecurity investments. The objective is no longer limited to preventing operational downtime or avoiding regulatory penalties. Organizations must now protect the competitive advantage that comes from years of scientific research and clinical development.
Identity has become the new perimeter
The most consistent pattern in recent healthcare breaches is not a novel exploit or a zero-day vulnerability. It is a legitimate credential in the wrong hands. Attackers are increasingly bypassing traditional defenses by targeting identities rather than infrastructure because a valid login is quieter, faster, and harder to distinguish from normal activity than any technical attack.
According to public reporting, the threat actors responsible for the Novo Nordisk breach allegedly maintained access for more than two months through compromised credentials, continuing to discover additional credentials even after portions of the intrusion had been detected. While those claims originate from the threat actor and remain unverified, they reflect a broader trend observed across many industries.
Healthcare environments have become increasingly identity-driven. Physicians, researchers, contractors, vendors, AI applications, cloud services, and connected medical devices all require credentials to access sensitive systems. Every new identity creates another potential entry point.
The same pattern appeared in the recent breach involving healthcare AI company Xsolis, where attackers reportedly compromised an employee account through phishing, ultimately affecting nearly 1.4 million individuals. The incident demonstrated that healthcare organizations are no longer managing only their own cyber risk. They also inherit risk from the growing network of AI vendors, cloud providers, and technology partners supporting modern care delivery.
This makes credential management significantly more important than it was only a few years ago. Multi-factor authentication remains essential, but organizations must also strengthen privileged access management, continuously monitor credential usage, rotate secrets, reduce excessive permissions, and rapidly revoke unnecessary access. Authenticated does not mean trusted, and security programs need to be built around that reality.
Artificial intelligence is expanding the attack surface
Artificial intelligence introduces another layer of complexity. Much of the public discussion around healthcare AI focuses on clinical accuracy, regulatory oversight, and workflow efficiency. Those conversations are important, but they overlook a quieter cybersecurity challenge.
Every AI platform introduces new identities, application programming interfaces, integrations, data repositories, and training datasets. At the same time, employees increasingly use publicly available generative AI tools to summarize documents, draft reports, analyze research, and accelerate administrative work. This is the shadow IT problem of the last decade, with a new shadow AI problem layered on top of it. Sensitive information can leave controlled environments long before security teams realize it has been shared, and once it enters a public model, it cannot be recalled.
This issue extends well beyond hospitals. Pharmaceutical companies, research institutions, contract research organizations (CROs), biotechnology firms, and healthcare technology companies all rely on collaborative digital ecosystems where scientific data moves continuously among internal teams and external partners. Each transfer creates another opportunity for sensitive research to be exposed if governance fails.
The path forward: Governance, not just technology
Traditional cybersecurity programs were largely designed to satisfy regulatory requirements and protect patient information. Those responsibilities remain critical, but they are no longer sufficient.
Healthcare organizations should approach AI and cybersecurity as business governance issues rather than isolated technology projects. Every organization should understand where sensitive research resides, who can access it, which AI tools are approved, what information may be entered into those systems, and how third-party vendors secure the data they receive.
Executive leadership should also recognize that intellectual property deserves the same level of protection as clinical systems. Drug discovery programs, research collaborations, AI models, and proprietary scientific data are strategic business assets that require dedicated security controls throughout their lifecycle. Several practical steps can significantly reduce exposure:
- Strengthen identity security: Continuously monitor privileged accounts, enforce multi-factor authentication, eliminate unnecessary permissions, and rotate credentials regularly.
- Establish AI governance: Approve secure AI platforms, define acceptable uses, classify sensitive information, and prevent proprietary research from being uploaded into unmanaged public AI tools.
- Reduce third-party risk: Evaluate AI vendors, cloud providers, contract research organizations, and technology partners using the same cybersecurity expectations applied internally.
- Protect research as a critical asset: Security programs should prioritize laboratories, clinical trial environments, research repositories, and intellectual property alongside electronic health records.
- Prepare for persistent attackers: Organizations should assume that determined threat actors may maintain access for extended periods. Continuous monitoring, behavioral analytics, rapid credential revocation, and incident response planning are essential to limiting damage.
Healthcare has always measured innovation by its ability to improve patient outcomes. As digital transformation accelerates, organizations must also measure innovation by their ability to protect the discoveries that make those outcomes possible. The Novo Nordisk incident is a reminder that patient records are no longer the only assets worth defending. Research environments, AI infrastructure, and scientific innovation now deserve equal attention, and in some cases, more of it. The next generation of healthcare cybersecurity will be defined not only by preventing breaches, but by preserving the scientific innovation that drives the future of medicine.
Photo: Traitov, Getty Images
Matt Kimpel is Chief Information Security Officer at Magna5, where he leads the company’s cybersecurity strategy, security operations, and compliance initiatives. He specializes in helping mid-market and regulated organizations strengthen cyber resilience, navigate evolving regulatory requirements, and adopt AI and emerging technologies securely. With more than a decade of experience in cybersecurity and IT engineering, Matt focuses on building practical security programs that combine technology, governance, and operational discipline to reduce risk across complex IT environments.
This post appears through the MedCity Influencers program. Anyone can publish their perspective on business and innovation in healthcare on MedCity News through MedCity Influencers. Click here to find out how.
