Ransomware Strikes: Inotiv’s Race Against Time to Restore Operations

Summary

• Inotiv Inc., a contract research company serving drug developers, was hit by ransomware in August 2025.
• The attack encrypted systems and disrupted some of its business operations.
• Research companies hold valuable data, which makes them targets.
• Inotiv brought in outside cybersecurity experts and notified law enforcement.
• The incident is the latest in a string of ransomware attacks on life sciences firms.

Ransomware disrupts a drug research firm

Inotiv Inc., a contract research organization that supports drug discovery and development, was hit by ransomware in August 2025. In an SEC filing on August 18, the company said it determined on August 8 that an attacker had gained access to its systems and encrypted some of them. The attack disrupted parts of its operations while the company worked to contain it.

For research work that depends on data integrity and tight timelines, that’s serious. Delays can ripple into clients’ drug programs.

Why pharma is a target

Drug research firms hold valuable intellectual property and confidential data, which makes them attractive to ransomware gangs. The Qilin ransomware group later claimed responsibility for the Inotiv attack.

An earlier version of this article cited a 20% increase in attacks on the sector attributed to Palo Alto Networks; that figure could not be confirmed and has been removed.

How exposed the sector is

Ransomware gangs pick targets that can’t afford downtime. Research labs fit. A quote attributed to a “David Johnson” of “SecureTech” in an earlier version could not be verified and has been removed.

Inotiv’s response

Inotiv said it moved to contain the attack, brought in outside cybersecurity specialists and notified law enforcement. Then it began restoring systems.

Inotiv later confirmed that the attacker had access between August 5 and August 8, and said it was notifying about 9,542 people whose personal, financial or health information could have been taken in the breach.

What other labs can learn

Inotiv is restoring systems and reviewing its security. Other research companies should take the cue. Check backups, segment lab systems from corporate IT, and rehearse a response.

What it means for life sciences

Ransomware in life sciences does more than cost money. It can delay research that patients are waiting on.

Governments and industry groups are pushing for more information sharing on attacks against healthcare and research. Small and mid-sized research firms often have the least to spend on defense, so shared intelligence matters most for them.

Lessons from the Inotiv attack

The Inotiv attack is another example of ransomware hitting the companies behind drug development. Attacks are growing in frequency and sophistication, and research firms are firmly on the target list.

The basics still matter most. Offline backups, multi-factor authentication, fast patching and a tested incident plan won’t stop every attack, but they decide how long a lab stays down.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.