--- title: AI, Data Minimization and Anonymization, and the Novo... description: The reported Novo Nordisk breach by FulcrumSec — claiming over 1TB of stolen data including pseudonymized clinical trial records, physician data, source code,... canonical: https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI, Data Minimization and Anonymization, and the Novo Nordisk Hack | daily.dev og:description: The reported Novo Nordisk breach by FulcrumSec — claiming over 1TB of stolen data including pseudonymized clinical trial records, physician data, source code,... og:url: https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7 og:image: https://api.daily.dev/og/posts/P6W0xvJx7.png og:image:alt: AI, Data Minimization and Anonymization, and the Novo Nordisk Hack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI, Data Minimization and Anonymization, and the Novo Nordisk Hack **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 17 min read · 0 upvotes · 0 comments ## Summary The reported Novo Nordisk breach by FulcrumSec — claiming over 1TB of stolen data including pseudonymized clinical trial records, physician data, source code, and internal AI models — exposes a fundamental flaw in how privacy law treats anonymization. Pseudonymized clinical data is not truly anonymous when an attacker holds auxiliary data (physician lists, trial metadata, AI model artifacts, emails) that can be combined via AI to reconstruct patient identities. The piece walks through HIPAA's de-identification standards (expert determination and safe harbor), the Common Rule's evolving definition of 'identifiable,' and GDPR's explicit acknowledgment that pseudonymized data remains personal data if reattribution is possible. Research is cited showing 99.98% reidentification rates using 15 demographic attributes and AI-based reidentification from chest X-rays and redacted clinical notes. The core argument is that breach risk must be assessed as a combined compromise — not field-by-field — and that operational data minimization (limiting access per environment, token, vendor, and pipeline) is the practical defense. The GitHub token vector is highlighted as a minimization and governance failure, not merely a technical one. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does removing patient names from clinical trial data make it legally anonymous under HIPAA or GDPR? No, removing names alone does not make data anonymous. Under GDPR Recital 26, pseudonymized data remains personal data if it can be attributed to a person through additional information; under HIPAA, de-identification requires no reasonable basis to believe the remaining information, alone or combined with other available data, could identify someone. Both frameworks require assessing identifiability in context, not just checking for direct identifiers like names. _Teams handling regulated health data can follow evolving legal and technical takes on anonymization standards through daily.dev._ ### How accurate is AI at reidentifying people from supposedly anonymized demographic data? Research by Rocher, Hendrickx, and de Montjoye found that generative models could correctly reidentify 99.98% of Americans in any dataset using just 15 demographic attributes, published in Nature Communications in 2019. Earlier work by Latanya Sweeney showed 87.1% of the US population is uniquely identifiable from just ZIP code, gender, and date of birth, demonstrating that ordinary non-name attributes function as identifiers when combined. _Developers building on health or user data can track reidentification research like this via daily.dev before it becomes a compliance surprise._ ### What data did the FulcrumSec hacking group claim to have stolen from Novo Nordisk? FulcrumSec claimed to have stolen more than a terabyte of data after spending over two months inside Novo Nordisk's networks, including source code, proprietary drug information, clinical trial data, employee, doctor and patient data, processing facility information, and internal AI model information. The group demanded $25 million and reportedly explored selling parts of the data privately after Novo Nordisk refused to pay. _Security teams evaluating breach exposure across combined datasets can follow incidents like this on daily.dev._ ## Similar posts on daily.dev - [Novo Nordisk Breach Exposes Software Development Pipeline Risk](https://daily.dev/posts/novo-nordisk-breach-exposes-software-development-pipeline-risk-mllmtnmow) · Dark Reading · 0 upvotes · 0 comments - [The Hidden PHI Problem in Medical Images: Building a Synthetic Dataset for AI De-Identification](https://daily.dev/posts/the-hidden-phi-problem-in-medical-images-building-a-synthetic-dataset-for-ai-de-identification-hmnqarnvt) · freeCodeCamp · 2 upvotes · 0 comments - [Gartner: most privacy incidents will soon come from AI inferences](https://daily.dev/posts/gartner-most-privacy-incidents-will-soon-come-from-ai-inferences-54qnwvvxr) · The Next Web · 1 upvotes · 1 comments - [How test data generators support compliance and data privacy](https://daily.dev/posts/how-test-data-generators-support-compliance-and-data-privacy-lkvlqqlxy) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#data-privacy](https://daily.dev/tags/data-privacy), [#gdpr](https://daily.dev/tags/gdpr) [View this post on daily.dev](https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI, Data Minimization and Anonymization, and the Novo Nordisk Hack","url":"https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7"},"datePublished":"2026-07-21T09:24:58.366Z","dateModified":"2026-09-14T06:02:04.505Z","description":"The reported Novo Nordisk breach by FulcrumSec — claiming over 1TB of stolen data including pseudonymized clinical trial records, physician data, source code,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a7f6d6d9e155883113ba968ca0e06a0e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a7f6d6d9e155883113ba968ca0e06a0e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-privacy,gdpr","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"AI, Data Minimization and Anonymization, and the Novo Nordisk Hack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-data-minimization-and-anonymization-and-the-novo-nordisk-hack-p6w0xvjx7#faq","mainEntity":[{"@type":"Question","name":"Does removing patient names from clinical trial data make it legally anonymous under HIPAA or GDPR?","acceptedAnswer":{"@type":"Answer","text":"No, removing names alone does not make data anonymous. Under GDPR Recital 26, pseudonymized data remains personal data if it can be attributed to a person through additional information; under HIPAA, de-identification requires no reasonable basis to believe the remaining information, alone or combined with other available data, could identify someone. Both frameworks require assessing identifiability in context, not just checking for direct identifiers like names. Teams handling regulated health data can follow evolving legal and technical takes on anonymization standards through daily.dev."}},{"@type":"Question","name":"How accurate is AI at reidentifying people from supposedly anonymized demographic data?","acceptedAnswer":{"@type":"Answer","text":"Research by Rocher, Hendrickx, and de Montjoye found that generative models could correctly reidentify 99.98% of Americans in any dataset using just 15 demographic attributes, published in Nature Communications in 2019. Earlier work by Latanya Sweeney showed 87.1% of the US population is uniquely identifiable from just ZIP code, gender, and date of birth, demonstrating that ordinary non-name attributes function as identifiers when combined. Developers building on health or user data can track reidentification research like this via daily.dev before it becomes a compliance surprise."}},{"@type":"Question","name":"What data did the FulcrumSec hacking group claim to have stolen from Novo Nordisk?","acceptedAnswer":{"@type":"Answer","text":"FulcrumSec claimed to have stolen more than a terabyte of data after spending over two months inside Novo Nordisk's networks, including source code, proprietary drug information, clinical trial data, employee, doctor and patient data, processing facility information, and internal AI model information. The group demanded $25 million and reportedly explored selling parts of the data privately after Novo Nordisk refused to pay. Security teams evaluating breach exposure across combined datasets can follow incidents like this on daily.dev."}}]} ```