Desk live·
ForensicPost
Ransomware/Analysis/File 25-1015b

The Pharmaceutical Year, and What the Corpus Cannot See in It

Three named incidents, one data class with no remedy, one concentration structure, one failure mode nobody would detect, and one harm that arrives years later.

Constructed geometry · not a chart of case data
TargetPharmaceutical sector
ActorMultiple
S. Rosler12 min readConfidence: medium2 sources reviewed

This file collects what the corpus recorded about pharmaceuticals in 2025 and what it could not.

What It Recorded

Inotiv at 25-0819b, with employee and partner data. Novo Nordisk at 25-0912b, with trial participant records including biomarkers and immunogenicity data. BioPharma Services at 25-1127c, discovered in November and claimed by Qilin.

Three incidents, all confidentiality, all surfaced because personal data was involved.

What It Could Not

Whether drug formulations or unpublished results were taken anywhere, at 25-0915b — no register would record it.

Whether any manufacturing record was altered, at 25-0921b — an integrity failure produces no notification, no outage and no listing.

Whether any research programme was delayed, at 25-0923c — the harm is deferred by years and distributed across people who will never know.

Whether the sector is affected disproportionately at all, at 25-0922b — three incidents among thousands of organisations establishes nothing.

The Pattern Is The Corpus’s Own

This database sees what notification law surfaces. In pharmaceuticals that is trial participants and employees, and it is not obviously the most consequential material the sector holds.

The corpus reached the same conclusion for manufacturing at 25-1204, law firms at 25-0916, and corporate records at 25-1124b. Pharmaceuticals is where the gap between what is recorded and what matters is widest, because the unrecorded categories include a medicine arriving later than it would have.

Graded medium: a synthesis across a thin sector sample, and the corpus is explicit that it cannot size what it is missing.

This is an analysis file

It synthesises the pharmaceutical files recorded in this database for 2025. Sources support the sector context; incidents are sourced in their own files. Corrections: corrections@forensicpost.com.

Sources
  1. Attackers are coming for drug formulas and patient dataHelp Net Security
  2. Two biopharma breaches and the FDA warning behind themcentrexIT
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary