Hackers claim breach exposing Moderna, J&J, Bayer employee data

Hackers are claiming to have breached a corporate intelligence provider, exposing employee data from 18 pharmaceutical and financial giants.

InfoDesk, a prominent enterprise intelligence software provider, has allegedly exposed the internal employee directories of several of the world’s most powerful pharmaceutical, medical, and financial institutions.

At least that’s what a threat actor claims. The breach, which allegedly occurred in February 2026, surfaced this week on a dark web forum where a threat actor is offering the compromised data for sale.

According to researchers at Cybernews who investigated the samples provided by the alleged attacker, the database contains employee records from 18 major organizations, including:

• Pharmaceutical and Biotech: Bayer, GSK, Johnson & Johnson, Merck, Moderna, Novo Nordisk, Sanofi, UCB, Argenx, Novonesis, and Vertex
• Medical Technology: Abbott, Medtronic, and Olympus
• Financial and Consulting: IMF and Kearney
• Consumer Health: Kenvue
• Nonprofit: AARP

What data has been allegedly stolen?

The threat actor claims to possess up to 1,000 records per company. However, they provided just a small data sample that includes full names and corporate email addresses. The sample included five records per company, including Infodesk itself.

Cybernews researchers warn that this data is the primary ingredient for spear-phishing.

"The impact here is primarily about targeted phishing attacks," they noted.

"With a verified list of names and emails from a specific vendor like InfoDesk, an attacker can craft highly convincing messages to harvest credentials or deploy malware within these organizations."

At the time of publication, InfoDesk has not officially responded to requests for comment regarding the alleged breach.

Third-party services are the Achilles’ heel of cybersecurity

The leak, if proven legitimate, represents a massive supply chain vulnerability, in which a single software vendor’s failure can place thousands at risk.

Last month, Sony's anime streaming service Crunchyroll was reportedly breached after ShinyHunters compromised an employee at third-party provider Telus, exposing an alleged 100GB of user data, including emails and credit card details.

In 2025, Scattered Spider hackers infiltrated M&S networks by phishing employees of third-party vendor Tata Consulting Services, using stolen employee login credentials. The attack knocked out retail giants' operations for a month.

A cyberattack on Salesloft's Drift application resulted in unauthorized access to Salesforce CRM data from companies using the third-party app, with Virgin Money and TD Bank, Cloudflare, Zscaler, Palo Alto Networks, Google, Allianz Life, TransUnion, Farmers Insurance, Air France, and KLM among the affected organizations.

Unlock more exclusive Cybernews content on YouTube.