Novartis Faces Class Action Lawsuit Over Alleged Unauthorized Sharing of Patient Health Data A Vermont-based cancer patient, identified as P.M., has filed a class action lawsuit against pharmaceutical giant Novartis, accusing the company of illegally sharing her sensitive health information with third parties, including Google and ContentSquare. The plaintiff, who received treatment with Novartis’ breast cancer therapy Kisqali, visited the drug’s website to access information and apply for a savings card only to later receive targeted advertisements related to her medical condition. The complaint alleges that Novartis embedded tracking pixels and other tools on its website, transmitting P.M.’s private data without her consent. The lawsuit claims the company prioritized marketing and profits over patient privacy, leading to emotional distress and a violation of medical confidentiality. This case is part of a growing trend of litigation in the U.S. and beyond, where corporations face accusations of unlawfully sharing user data via tracking technologies, particularly those from Google and Meta. Last month, New York’s Northwell Health settled a similar class action over data harvested from its patient portal, while a California federal court previously ruled that pixel-tracked data from public webpages did not constitute a breach of protected health information (PHI). Novartis, one of the largest pharmaceutical companies targeted in such lawsuits, is under scrutiny for allegedly deploying these trackers across multiple product websites, including those for Cosentyx (immunology), Entresto (heart failure), Leqvio (cholesterol), and Pluvicto (prostate cancer). The plaintiff argues that the trackers violate HIPAA, the Electronic Communications Privacy Act (ECPA), and other legal protections, including breach of contract and fiduciary duty. The lawsuit seeks an injunction against the use of tracking tools, damages, and legal fees. Given the widespread use of such technologies in the pharmaceutical industry, the case is expected to draw significant attention.

Pharmaceutical giant Novartis was targeted in a recent cyberattack by the Industrial Spy data-extortion gang. The hacking group began selling data allegedly stolen from Novartis on their Tor extortion marketplace for $500,000 in bitcoins. The data being sold consists of 7.7 MB of PDF files containing information related to RNA and DNA-based drug technology and tests from Novartis and were stolen "directly from the laboratory environment of the manufacturing plant.