AI, Data Minimization and Anonymization, and the Novo Nordisk Hack

The report examines claims that the FulcrumSec extortion group stole over 1TB of Novo Nordisk data—including pseudonymized clinical-trial records, physician and patient information, source code, and AI model artifacts—and warns that in an era of powerful AI and auxiliary datasets, pseudonymization alone may not prevent reidentification; it outlines regulatory implications (HIPAA, Common Rule, GDPR) and urges operational data minimization, stronger access controls, and governance to reduce combined-compromise risk.