Inotiv has confirmed a major data breach after a Qilin ransomware attack exposed the personal, financial and health information of over 9,000 people. The hit on this large US research company highlights rising supply chain risks across the pharmaceutical and healthcare sectors.
Critical React flaw React2Shell is under active state sponsored exploitation, allowing unauthenticated remote code execution across thousands of web apps. ACSC and US CISA have issued urgent warnings, calling on Australian organisations to patch immediately.
Australia’s National AI Plan is a welcome start on skills and safety, but it plays too safe. While the US, Europe and the Gulf pour sovereign capital into chips, compute and energy, Canberra is still talking about catalysing investment rather than committing.
Inotiv has confirmed a major data breach after a Qilin ransomware attack exposed the personal, financial and health information of over 9,000 people. The hit on this large US research company highlights rising supply chain risks across the pharmaceutical and healthcare sectors.
Cyber News Centre's cyber update for 9th December 2025: Inotiv, a US-based pharmaceutical contract research organisation, has confirmed it suffered a significant data breach following a ransomware attack in August.
Inotiv is a contract research organisation (CRO) that provides nonclinical and analytical drug discovery and development services. The Indiana-headquartered company supports clients from initial discovery through to the investigational new drug (IND) application stage and beyond, also supplying critical research models.
Update: Indiana-based pharmaceutical research company Inotiv has confirmed that a ransomware attack in August 2025 exposed the sensitive data of 9,542 individuals. The incident, claimed by the Qilin ransomware group, occurred between August 5 and August 8, compromising a wide range of personal, financial, and health information. According to filings with the Maine Attorney General's Office, the stolen data includes names, addresses, Social Security numbers, driver's license numbers, financial account details, and medical and health insurance information.
The breach affected current and former employees, their family members, and other individuals who had interacted with Inotiv or its acquired companies. The Qilin group claimed to have exfiltrated 176 GB of data, including financial records and research contracts. Inotiv, which has over 2,000 employees and reported revenues exceeding $500 million, stated it has restored its systems and is providing 24 months of credit monitoring to affected individuals while continuing to assess the full financial impact.
Why it Matters: This attack on Inotiv highlights the significant and growing threat of supply chain attacks within the pharmaceutical and healthcare sectors. As contract research organisations (CROs) handle vast amounts of proprietary intellectual property and sensitive patient data for multiple clients, they represent a high-value target for ransomware groups like Qilin.
A single breach can have cascading consequences, disrupting drug development timelines and exposing the confidential data of numerous partner organisations. The incident demonstrates that even entities not directly providing patient care are critical infrastructure within the healthcare ecosystem, holding data that is immensely valuable on the dark web and making them prime targets for extortion.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
Critical React flaw React2Shell is under active state sponsored exploitation, allowing unauthenticated remote code execution across thousands of web apps. ACSC and US CISA have issued urgent warnings, calling on Australian organisations to patch immediately.
A significant supply chain attack has struck the US financial sector, with fintech vendor Marquis Software Solutions confirming a ransomware incident that exposed the sensitive data of hundreds of thousands of customers from dozens of American banks and credit unions.
South Korean e-commerce giant Coupang has confirmed a massive data breach exposing the personal information of 33.7 million customers. The incident, which began in June 2025, is one of the largest in the nation's history and is linked to a former employee's active credentials.
A series of cyber attacks on Australian defence supply chain contractors has exposed sensitive material relating to major weapons programs, including the Redback infantry fighting vehicle.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
