Drug R&D Firm’s IT, Data Encrypted in Alleged Qilin Attack

Inotiv, a drug research and development firm, told federal regulators that it’s been dealing with a cyberattack since Aug. 8 that has encrypted some IT systems and data, and is disrupting certain business operations. Ransomware gang Qilin has listed the company as a victim on its dark website.

See Also: What Manufacturing Leaders Are Learning About Cloud Security – from Google’s Frontline

Inotiv’s filing to the Securities and Exchange Commission on Monday said its preliminary investigation into the incident found that a threat actor accessed and encrypted certain company systems.

“The company took steps to contain, assess and remediate the cybersecurity incident, including initiating an investigation, engaging external cybersecurity specialists, and restricting access to certain of its systems. The company has also notified law enforcement,” Inotiv told the SEC.

Indiana-based Inotiv, which reported revenue of nearly $471 million in fiscal 2024, is a contract research organization that works with clients in new drug discovery and development in a wide range of therapeutics areas, including cardiovascular, neuroscience, oncology, pulmonary, infectious diseases and many more.

“The cybersecurity incident has caused, and is expected to continue to cause, disruptions to certain business operations of the company,” Inotiv told the SEC. “The incident has temporarily impacted the availability of and access to certain of the company’s networks and systems, including access to portions of internal data storage and certain internal business applications.”

The report to the SEC did not provide details on the scope of impact on the business operations or the types of IT systems affected.

Inotiv said it is working to bring the affected portions of its systems back online. “In addition, and at the same time, the company initiated its business continuity strategy and has transitioned certain operations to offline alternatives with the aim of reducing disruption to its business,” Inotiv said.

The timeline for full restoration is unknown at this time, and the company has not yet determined whether the incident is reasonably likely to have material impact on financial performance, Inotiv said.

In a September 2024 SEC filing related to Inotiv’s 2024 fiscal year financial results, the company said its cybersecurity risk management framework “is grounded in external standards, specifically those of the National Institute of Standards and Technology and the Center for Internet Security.”

“We deploy a multifaceted security strategy that includes multifactor authentication, advanced malware defenses and comprehensive endpoint protection supported by extended detection and response technology.” Additionally, Inotiv told the SEC that it leverages a third-party provider of managed XDR services, “which provides continuous monitoring across our environment to respond swiftly to potential security events.”

Inotiv said it uses a comprehensive process to oversee and identify cyberthreats associated with its third-party service providers. “For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices and automated rating systems to assess vendors’ cybersecurity postures,” Inotiv told the SEC.

Inotiv did not immediately respond to Information Security Media Group’s request for comment and additional details about the incident, including Qilin’s dark web claims of the company being one of its victims.

Russian-speaking Qilin has been behind other previous attacks on organizations in the healthcare sector, including those that conduct medical laboratory work.

For example, a June 2024 ransomware attack on British pathology laboratory services provider Synnovis disrupted patient care and testing services at several London-based National Health Services hospitals and triggered a nationwide shortage of type O-negative blood in the United Kingdom (see: Breach Roundup: UK NHS Links Patient Death to Ransomware Attack).

“Qilin has been one of the more aggressive ransomware-as-a-service groups targeting healthcare and pharma in recent years,” said Scott Weinberg, CEO of managed services firm Neovera. “They’re known for their double-extortion tactics, and their leaked site activity shows a clear pattern of prioritizing victims with high regulatory exposure or mission critical operations,” he said.

“The group continues to raise the stakes and advance its toolset to find new ways to pressure victims.”

Taking Action

When it comes to cyberattacks on pharmaceutical industry companies overall, a primary concern is whether the attacker was able to access drug formula or trial data, said Jeff Wichman, director of incident response at security firm Semperis.

“Most pharma companies will separate this type of data from being generally accessible, but attackers are smart,” he said. “If the attacker was able to obtain the formula, they may look at a secondary extortion of selling the formula to other vendors. If the attacker was able to modify the formula or trial data that could very well be a life/death type risk.”

The recent surge in cyberattacks targeting major corporations and public institutions underscores the importance of strong access controls as an effective defense against modern threats, he said.

“One of the most impactful ways organizations can mitigate these risks is by implementing tiered access controls,” he said.

By segmenting systems and data based on sensitivity and necessity, companies can drastically reduce the potential damage from a compromised account, Wichman said.

“This approach limits lateral movement, protects critical assets and enhances visibility into anomalous behavior.”