Hackers steal Pfizer-BioNTech vaccine data from European drug agency

LONDON • American drugmaker Pfizer and its German partner BioNTech on Wednesday said that documents related to the development of their Covid-19 vaccine had been "unlawfully accessed" in a cyber attack on Europe's medicine regulator.

The European Medicines Agency (EMA), which assesses medicines and vaccines for the European Union, said hours earlier it had been targeted in a cyber attack. It gave no further details.

Pfizer and BioNTech said they did not believe any personal data of trial participants had been compromised, and EMA "has assured us that the attack will have no impact on the timeline for its review".

It was not clear when or how the attack took place, who was responsible or what other information may have been compromised.

The two companies said they had been informed by the EMA "that the agency has been subject to a cyber attack and that some documents relating to the regulatory submission for Pfizer and BioNTech's Covid-19 vaccine candidate" had been viewed.

Such documents could be extremely valuable to other countries and companies rushing to develop vaccines, experts said.

Mr Marc Rogers, founder of CTI-League, a volunteer group fighting Covid-related breaches, said: "When it comes to the data submitted to these kinds of regulatory bodies, we are talking confidential information about the vaccine and its mechanism of action, its efficiency, its risks and known possible side effects, and any unique aspects such as handling guidelines.

"It also provides detailed information on other parties involved in the supply and distribution of the vaccine."

The pharmaceutical companies said "no BioNTech or Pfizer systems have been breached in connection with this incident, and we are unaware that any study participants have been identified through the data being accessed".

The Pfizer-BioNTech vaccine is a top contender in the global race to beat back Covid-19. It is already being administered in Britain.

EMA has said it would complete its review by Dec 29, although its schedule may change.

The EMA statement gave few details about the attack, saying only that it was investigating with help from law enforcement.

"EMA cannot provide additional details while the investigation is ongoing," it said in a statement.

Since the coronavirus pandemic began, hackers have targeted a slew of pharmaceutical and vaccine development firms including Gilead, Johnson & Johnson, Novavax and Moderna.

Mr Rogers, who is also a vice-president at security company Okta, said: "Vaccine candidates represent liquid gold to many parties, both in terms of the opportunity and the pure market value."

BLOOMBERG, REUTERS