EU agency in charge of COVID-19 vaccine approval says it was hacked
COVID-19 named by WHO for Novel coronavirus NCP concept. Doctor or lab technician holding blood sample with novel (new) coronavirus N.C.P. in Wuhan, Hubei Province, China, medical and healthcare
The European Medicines Agency (EMA), the EU regulatory body in charge of approving COVID-19 vaccines, said today it was the victim of a cyber-attack.
In a short two-paragraph statement posted on its website today, the agency discloses the security breach but said it couldn't disclose any details about the intrusion due to an ongoing investigation.
EMA is currently in the process of reviewing applications for two COVID-19 vaccines, one from US pharma giant Moderna, and a second developed in a collaboration between BioNTech and Pfizer.
An EMA spokesperson did not return a request for comment seeking information if the attack targeted its vaccine approval process or if it was a financially-motivated attack like ransomware.
Nonetheless, in a follow-up statement released on its own website, BioNTech said that "some documents relating to the regulatory submission for Pfizer and BioNTech's COVID-19 vaccine candidate, BNT162b2, which has been stored on an EMA server, had been unlawfully accessed" during the attack, confirming that COVID-19 research was most likely the target of the attack.
Over the past months, numerous companies working on COVID-19 research and vaccines have been the targets of hackers, and especially of state-sponsored hacking groups.
Companies like Johnson & Johnson, Novavax, Genexine, Shin Poong Pharmaceutical, Celltrion, AstraZeneca, Moderna, and Gilead have been targeted by hackers, according to reports from Reuters and the Wall Street Journal.
In November, OS maker and cyber-security giant Microsoft said it detected three nation-state hacking groups (known as APTs) targeting seven companies working on COVID-19 vaccines, singling out Russia's Strontium (Fancy Bear) and North Korea's Zinc (Lazarus Group) and Cerium for the attacks.
Speaking at the Aspen Cyber Summit last week, Marene Allison, the Chief Information Security Officer at Johnson & Johnson, said companies like her employer are seeing cyber-attacks from nation-state threat actors "every single minute of every single day."
IBM also reported last week that hackers were looking to compromise companies working in the "cold chain" of COVID-19 vaccines.
EMA said it would provide further information on the hack once they learn more.