Novo Nordisk Stock Rose 5% Despite a $75M Ransomware Crisis — Oral Wegovy Was the Reason

Novo Nordisk's shares surged roughly 5% on Friday, June 19, 2026, capping a week that saw the stock climb more than 5.5% . The rally came even as the Danish pharmaceutical giant faced a severe cyber extortion crisis: the hacking group FulcrumSec stole 1.3 terabytes of proprietary data, demanded up to $75 million in ransoms, and began leaking sensitive files after the company refused to pay. The reason investors shrugged off the breach? The commercial momentum behind the oral Wegovy pill and a key analyst upgrade, which together provided fundamental catalysts the market prioritized over the cyberattack.

Why the Stock Rose Despite the Breach

Oral Wegovy's Historic U.S. Launch

The launch of oral Wegovy (semaglutide tablets 25 mg) on January 5, 2026 has been one of the most successful pharmaceutical rollouts in recent U.S. history . Key numbers:

• 3+ million prescriptions in just over five months .
• The pill crossed one million scripts within the first 12 weeks, then accelerated to three million by early June .
• Roughly 80% of new oral Wegovy patients are new to GLP-1 therapy entirely, indicating the pill is expanding the obesity treatment market rather than just cannibalizing injectable Wegovy .
• Available at 70,000+ U.S. pharmacies, including Amazon Pharmacy, CVS, Costco, and telehealth providers like Ro, LifeMD, and Weight Watchers .
• Novo Nordisk calculates this translates to roughly one prescription filled every five seconds over the launch period .

Medicare Coverage Catalyst

The Medicare GLP-1 Bridge program is set to begin July 1, 2026, offering oral Wegovy at a $50 monthly copay for eligible seniors . This coverage unlock is widely expected to dramatically expand the addressable patient pool in the second half of the year, providing a clear near-term growth catalyst.

Berenberg Price Target Upgrade

On June 17–18, 2026, Berenberg analyst Kerry Holford raised the price target on Novo Nordisk from DKK 300 to DKK 325 and reiterated a Buy rating . The upgrade reflected confidence that oral Wegovy's trajectory will hit the upper end of the company's full-year guidance, with the pill identified as the decisive growth driver . The new target implies roughly 14% upside from the then-current share price of around DKK 280 .

The FulcrumSec Data Breach and Extortion

While the cyber crisis was serious, it did not derail the stock because the company confirmed that core business and manufacturing operations were unaffected . Here are the details:

How It Happened

• FulcrumSec infiltrated Novo Nordisk's network in March 2026 by exploiting exposed Azure and GitHub credentials — specifically a leaked GitHub token .
• The group spent over two months moving laterally across cloud environments before making contact with executives on June 1 .

What Was Stolen (1.3 TB)

The exfiltrated data includes :

• Source code for internal systems
• Confidential pharmaceutical research and clinical trial records covering roughly 11,500 participants
• 30 trained AI drug models (some sources report 24 proprietary AI models)
• 494 GB of cell-painting microscopy images
• Employee and physician information, production-system details, and drug pipeline files

The Ransom Demands

Demand	Amount	Status
FulcrumSec initial ransom	$25 million	Novo Nordisk refused to pay; FulcrumSec began leaking data on June 15
A second, separate extortion demand	$50 million	Reported by some sources as a separate demand, bringing the total to $75 million
Total	~$75 million	Both demands went unpaid as of Friday's close

Multiple sources reliably report the $25 million FulcrumSec demand . The $50 million second demand is referenced in several reports but has not been as consistently corroborated across major outlets. The $75 million total figure should be treated with mild caution — the $25 million portion is firmly confirmed.

FulcrumSec subsequently began selling portions of the data on dark-web forums after the ransom refusal, publishing 264 GB publicly and soliciting private buyers for the remaining trove .

Broader Stock Context and the February Decline

• The stock had declined nearly 20% in early February 2026 amid U.S. pricing pressure concerns, including potential drug pricing reforms and competitive dynamics that weighed on the entire GLP-1 sector .
• Over the prior twelve months, the stock was still down roughly 41% from its highs, and at ~€38 (around DKK 285) it sat about 8% below its 200-day moving average .
• The oral Wegovy launch has since changed the sentiment trajectory, but the stock remains well off its all-time peaks.

Why Investors Looked Past the Breach

The market effectively judged the cyberattack as a reputational and legal liability, not a business disruption. The company stated that manufacturing, clinical trials, and commercial operations continued normally, and the stolen data — while sensitive — did not interrupt Wegovy's supply or prescription fulfillment . Meanwhile, the oral Wegovy prescription numbers, the Medicare catalyst, and the Berenberg upgrade provided fundamental catalysts that the market prioritized. The stock's rally pushed it decisively above its short-term moving average, a sign that investors were betting on the company's rapid pivot to oral obesity therapies rather than fixating on cybersecurity risks .