Medtronic says a third party accessed data in corporate IT systems, while ShinyHunters claims more than nine million records were stolen. The incident did not disrupt products or patient care, but it exposes the widening risk around corporate IT, identity data and medical technology supply chains.
Australia’s A$25bn AI wager, Bezos’s leap into “physical AI” and Musk’s push to shift data centres into orbit turned this week into a defining moment in the AI global industrial contest, with the Global South emerging as both proving ground and prize in the new AI steel age.
Vercel confirms a security incident after a compromised third-party AI tool's OAuth token allowed attackers to pivot into internal systems, exposing environment variables and API keys across its platform.
Inotiv has confirmed a major data breach after a Qilin ransomware attack exposed the personal, financial and health information of over 9,000 people. The hit on this large US research company highlights rising supply chain risks across the pharmaceutical and healthcare sectors.
Cyber News Centre's cyber update for 9th December 2025: Inotiv, a US-based pharmaceutical contract research organisation, has confirmed it suffered a significant data breach following a ransomware attack in August.
Inotiv is a contract research organisation (CRO) that provides nonclinical and analytical drug discovery and development services. The Indiana-headquartered company supports clients from initial discovery through to the investigational new drug (IND) application stage and beyond, also supplying critical research models.
Update: Indiana-based pharmaceutical research company Inotiv has confirmed that a ransomware attack in August 2025 exposed the sensitive data of 9,542 individuals. The incident, claimed by the Qilin ransomware group, occurred between August 5 and August 8, compromising a wide range of personal, financial, and health information. According to filings with the Maine Attorney General's Office, the stolen data includes names, addresses, Social Security numbers, driver's license numbers, financial account details, and medical and health insurance information.
The breach affected current and former employees, their family members, and other individuals who had interacted with Inotiv or its acquired companies. The Qilin group claimed to have exfiltrated 176 GB of data, including financial records and research contracts. Inotiv, which has over 2,000 employees and reported revenues exceeding $500 million, stated it has restored its systems and is providing 24 months of credit monitoring to affected individuals while continuing to assess the full financial impact.
Why it Matters: This attack on Inotiv highlights the significant and growing threat of supply chain attacks within the pharmaceutical and healthcare sectors. As contract research organisations (CROs) handle vast amounts of proprietary intellectual property and sensitive patient data for multiple clients, they represent a high-value target for ransomware groups like Qilin.
A single breach can have cascading consequences, disrupting drug development timelines and exposing the confidential data of numerous partner organisations. The incident demonstrates that even entities not directly providing patient care are critical infrastructure within the healthcare ecosystem, holding data that is immensely valuable on the dark web and making them prime targets for extortion.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
Medtronic says a third party accessed data in corporate IT systems, while ShinyHunters claims more than nine million records were stolen. The incident did not disrupt products or patient care, but it exposes the widening risk around corporate IT, identity data and medical technology supply chains.
Vercel confirms a security incident after a compromised third-party AI tool's OAuth token allowed attackers to pivot into internal systems, exposing environment variables and API keys across its platform.
According to Microsoft’s April 2026 Security Update Guide, the company fixed more than 160 vulnerabilities across Windows, Office and core services, including an actively exploited SharePoint zero‑day and a Defender privilege‑escalation flaw.
The largest DeFi exploit of 2026 has seen $293 million drained from Kelp DAO's LayerZero cross-chain bridge, triggering a $5.4 billion withdrawal panic across the broader ecosystem and exposing critical centralization flaws in modular security.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
