Clop Ransomware Leaks Stolen Data from U.S. Pharma Firm ExecuPharm After Failed Negotiations The Clop ransomware group has published sensitive data stolen from ExecuPharm, a U.S.-based contract research organization (CRO) serving the pharmaceutical industry, after ransom negotiations collapsed. The attack, disclosed by ExecuPharm in a data breach notification filed with Vermont’s Attorney General, occurred on March 13, 2020, following a successful spearphishing campaign targeting employees. ExecuPharm, which employs over 18,000 clinical specialists globally, confirmed that attackers encrypted its servers and demanded a ransom in exchange for decryption. The company restored affected systems from backups but refused to pay, prompting Clop to leak the stolen data on its dark web portal. According to Clop, negotiations initially progressed including a 20% discount on the ransom but stalled when ExecuPharm allegedly ceased communication. The leaked data includes 19,000 employee emails (from ExecuPharm and its parent company, Parexel), 80,000+ email correspondences, and 163GB of sensitive documents, such as financial records, accounting files, and SQL backups of the company’s document management system. Compromised personal information encompasses Social Security numbers, passport details, bank account numbers, credit card data, and national ID numbers, raising risks of identity theft and fraud. ExecuPharm reported the incident to U.S. law enforcement and engaged third-party cybersecurity firms to investigate. The company has since implemented enhanced security measures, including forced password resets, multi-factor authentication (MFA) for remote access, and advanced endpoint protection tools. Clop has targeted other high-profile organizations, including Maastricht University, which paid a 30 Bitcoin ransom in February 2020 after a similar spearphishing attack. The group claims to avoid attacking hospitals, charities, and pharmaceutical firms involved in COVID-19 vaccine or drug development, offering free decryption to the latter if they provide proof of their work. However, Clop has previously listed and later removed other pharmaceutical companies from its leak site.