Pharma giant AstraZeneca claimed by hackers, with source code on the table

AstraZeneca, the Swedish-British pharmaceutical behemoth, has been posted on a hacker blog. The attackers claim they have access to the company’s source code, cloud infrastructure, and various keys.

AstraZeneca’s name appeared on Lapsus$' blog, which it uses to showcase its latest victims. According to the attackers, they managed to syphon several gigabytes of the company’s data, including “full source code” and employee details. The data appears to have been posted to a dark web data leak forum as well.

The Cambridge-headquartered pharma giant is among the largest market players globally, with reported 2025 revenue exceeding $58.7 billion and a workforce of around 90,000.

We have reached out to the company for and will update the article once we receive a .

According to Lapsus$ posts spread across at least two different platforms, the attackers managed to access a variety of the company’s databases, exposing:

The Cybernews research team investigated data samples Lapsus$ shared on its Telegram channel and found that at least some of its claims appear legitimate. For example, our team found that the sample includes GitHub user information for those who work on AstraZeneca's internal software. The dataset supposedly includes:

Another sample included employee information, revealing personal details of individuals working across various AstraZeneca-related clinical research companies. The datasets allegedly reveal:

Meanwhile, the third sample attackers shared appeared to contain a tree structure of internal company software source code.

If Lapsus$ claims were confirmed, AstraZeneca could face a cascade of threats. For one, aggressive competitors or threat actors could attempt to exploit the source code to scour for vulnerabilities that could penetrate deep into the company’s systems.

It’s almost a given that a multi-billion-dollar pharmaceutical company is working on numerous projects that require years of research and development, which means exposing their secrets could come at a steep price.

“If the gang really has the company’s source code, attackers could exploit it to identify current vulnerabilities. For example, attackers may discover hardcoded secrets or credentials in the code, which may eventually lead to exposure of intellectual property,” our team explained.

Meanwhile, individuals whose details were exposed in the attack could face an increased risk of targeted social engineering attacks. Since Lapsus$ has cooperated with notorious social engineering gangs, such as ShinyHunters, in the past, exposed individuals with high-level access could be especially vulnerable.

The gang gained attention in 2022 after several attacks against major corporations, including Okta, Nvidia, Samsung, and T-Mobile. However, several members of the group have been arrested in the UK .

Most recently, the gang claimed a data breach of Adidas Extranet , supposedly accessing data such as user names, passwords, and extensive technical information.

However, the Adidas spokesperson said there was no indication that the company's IT infrastructure, its e-commerce platform, or any consumer data were affected by the incident.

In a report late last year , Resecurity researchers said that Lapsus$, together with Scattered Spider and ShinyHunters, are three of the most notorious English-speaking cybercrime groups operating today

Unlock more exclusive Cybernews content on YouTube.