Novo Nordisk CEO Addresses Arrest of Hackers Linked to Cyberattack

Novo Nordisk's media relations director, Lars Otto Andersen-Lange, issued a statement regarding the arrest of two young men in Australia, believed to be associated with the hacker group TeamPCP. The company clarified that it was not involved in the Australian case but acknowledged its own cybersecurity incident earlier this year. TeamPCP is known for a global supply chain attack on the open-source tool TanStack, which occurred on May 11, 2026, and for compromising numerous code repositories on GitHub.

Following the attack, Novo Nordisk had shut down its code repositories, referring to the situation as an IT security incident. The Australian Federal Police confirmed the arrests of the two suspects, aged 21 and 23, with one identified as Ruben Thomson. CEO Mike Doustdar expressed his approval of the authorities' actions, stating that cybercrime should not be tolerated and emphasizing the importance of collaboration among judicial authorities, businesses, and cybersecurity experts to protect stakeholders.

Despite the company's comments, questions remain about why Novo Nordisk chose to address the arrests now, especially given its previous silence on the matter. IT security expert Per Silberg Hansen noted that companies typically exercise caution in disclosing information that could affect their share prices. Some experts suggest that Doustdar's remarks indicate a strong likelihood that TeamPCP targeted Novo Nordisk.

The company has previously faced data leaks from another group, FulcrumSec, and there are indications that TeamPCP and FulcrumSec may have been in contact. Ethical hacker Emil Hørning, who linked TeamPCP to the shutdown of Novo Nordisk's code repository, theorized that the company might have been dealing with simultaneous threats from both groups. He highlighted the possibility of different methods of accessing Novo Nordisk's data, suggesting that the two hacker groups could have operated independently.

Thomas Wilkan, a cybersecurity researcher, pointed out that the alleged hackers made significant operational security mistakes, which may have led to their identification. He noted that the investigation has uncovered traces of their activities, further complicating the narrative surrounding the cyberattack.

Novo Nordisk encourages anyone with information about the cyberattack to contact journalist Mats Magnussen confidentially.