The Eclipse ransomware group has added Crystal Pharmatech, a pharmaceutical development and manufacturing services firm, to its leak site, claiming to have stolen internal data.
Threat trackers recorded the listing on August 21. Eclipse is a newer operation, and GalaxyWarden rated the claim high severity while flagging it as unconfirmed. RansomLook carried the same entry the same day.
Crystal Pharmatech provides solid-state research, crystallization, preformulation, formulation development and manufacturing, and clinical supply services for drug developers. It runs R&D centers in Suzhou, China, New Jersey, San Francisco, and Toronto, placing it inside the supply chain for multiple drug candidates.
The company was also claimed by the Qilin group in early August, a separate listing that researchers have not tied to this one. Repeated targeting of the same firm by different gangs is a reminder that pharma services companies hold formulations, stability data, and client project details that are valuable to extortionists.
For drug developers, the incident is a supply chain signal. Contract research and manufacturing organizations are repositories of sensitive clinical and formulation data, and a compromise at one vendor can touch many sponsors. Biopharma companies should review CDMO contracts for security clauses, data segregation, and breach notification timelines, and confirm partners test backups and segment research networks from general IT.
