A pair of drug developers had their patient claims analytics environments named on an extortion crew’s leak page within twenty seconds of each other, and the group says the data is already public.
N0n posted Cogent Biosciences on November 6, describing a claims analytics environment holding millions of patient claim rows with patient, claim and provider identifiers plus full diagnosis code detail. The listing marks the data “not paid, exposed,” which in this operation’s usage means the ransom clock expired. The same crew logged Dompé Farmaceutici moments earlier, claiming a claims warehouse behind the Italian manufacturer’s United States ophthalmology business: patient dimension tables, drug and plan dimensions, and archives of prescriptions and diagnosis claims.
Why claims warehouses are exposed
Neither company has publicly confirmed an intrusion. Independent trackers logged both claims on November 6, so the listing is documented even where the breach is not.
Claims warehouses are built to be joined and queried, so the data is already normalized into something a buyer can use: one row links a person to a specialty, a prescriber, a pharmacy and a date of service. Diagnosis codes turn that into a discrimination problem, not just an identity-theft one. For a clinical-stage oncology company the same tables may carry trial-adjacent identifiers never meant to leave a research enclave.
Ask narrow questions this week. Which analytics environments hold identifiable claims data, and do they sit on the same identity plane as production? Does the warehouse service account require multifactor authentication, and does anyone review its egress volume? Retention matters too: ten years of claim rows means ten times the data when copied.
N0n has leaned on pharmaceutical and biotech names repeatedly this autumn. MedRisk could not independently confirm either claim. A leak-site entry is a criminal allegation, not a verified breach.
