Forma Therapeutics Ransomware Claim by Nightspire (Sep 2026)

Claim Summary

On or around September 21, 2026, a ransomware group calling itself “nightspire” allegedly listed Forma Therapeutics Holdings, Inc. on its dark web leak site. Forma Therapeutics is a US-based clinical-stage biopharmaceutical company focused on hematologic diseases and cancer research. According to the threat actor’s post, the group claims to have exfiltrated clinical trial and statistical data, electronic lab notebooks, drug discovery and pipeline information, and biological and genomic research data. The claimed data volume was not disclosed.

Notably, the leak site entry lists the domain www.novonordisk.com, which is inconsistent with the named victim. This discrepancy may indicate a template error, a misattributed listing, or an attempt to associate the claim with a larger parent organization. Novo Nordisk acquired Forma Therapeutics in 2022, which could explain the domain reference, but this remains speculation. Yazoul Security has not independently verified any portion of this claim.

Threat Actor Profile

The claim originates from nightspire, a ransomware operation with no publicly documented research, tooling, or victim history available at the time of writing. Our analysts could not confirm known tools, tactics, or procedures (TTPs) associated with this group. The absence of a track record is significant: it means we cannot assess whether nightspire has the technical capability or intent to follow through on its claims.

Groups with little to no verifiable history sometimes exaggerate data holdings to pressure victims into paying quickly. Others are rebrands of established operations. Until corroborating evidence emerges, nightspire should be treated as an unproven actor. No YARA rules or detection signatures specific to this group are currently available in our intelligence library. Organizations seeking general ransomware detection guidance can review our advisory index at /advisory/.

Alleged Data Exposure

The threat actor claims the following categories of data were taken:

• Clinical trial and statistical data
• Electronic lab notebooks and research intellectual property
• Drug discovery and pipeline data
• Biological and genomic research data

If accurate, this would represent highly sensitive material. Clinical trial data and genomic information carry significant regulatory, privacy, and competitive implications. However, ransomware groups frequently misrepresent the scope or nature of stolen data. Some claims are inflated, recycled from other victims, or entirely fabricated. No samples, file listings, or proof-of-existence artifacts have been publicly reviewed by Yazoul Security, and we will not link to or reproduce any leaked material.

Potential Impact

Should the claim prove accurate, potential consequences could include:

• Regulatory scrutiny under HIPAA, GDPR, or FDA frameworks if patient or trial participant data is involved
• Loss of competitive advantage from exposed pipeline or discovery research
• Reputational harm to Forma Therapeutics and its parent organization
• Possible notification obligations to trial participants, partners, and regulators

At this stage, all of the above remain hypothetical. There is no confirmed evidence that data was exfiltrated, that the data is genuine, or that affected parties have been notified.

What to Watch For

• Official statements from Forma Therapeutics or Novo Nordisk confirming or denying the claim
• Regulatory filings or breach notifications referencing this incident
• Emergence of proof-of-existence samples from the threat actor
• Any rebranding or attribution linking nightspire to a known ransomware operation
• Updates to our actor profile at /intel/actor/nightspire/ as new information becomes available

Disclaimer

This report is based entirely on an unverified claim published by a ransomware group on its leak site. Yazoul Security has not independently confirmed the authenticity, scope, or accuracy of this claim. The information presented here should not be treated as fact. Ransomware actors routinely exaggerate, misattribute, or fabricate claims to pressure victims. No data samples, credentials, download links, or access instructions are included in this report by design. Readers should rely on official statements from the affected organization and authoritative incident response sources before drawing conclusions.