EU drug regulator hacked, data on COVID-19 vaccine accessed

The Amsterdam-based agency, which is considering requests for conditional marketing authorisation for several coronavirus vaccines to be used in the 27-nation European Union, said earlier on Wednesday that it had been the target of a cyberattack.

The EMA declined to provide more details of the attack while the investigation was continuing, but the two companies later released a statement saying that “some documents relating to the regulatory submission for Pfizer and BioNTech's COVID-19 vaccine candidate, BNT162b2, which has been stored on an EMA server, had been unlawfully accessed”.

They added that no BioNTech or Pfizer systems had been breached in connection with the incident and that they weren't aware that any study participants had been identified as a result of the data being accessed.

"At this time, we await further information about EMA's investigation and will respond appropriately and in accordance with EU law,” the companies said. “EMA has assured us that the cyber attack will have no impact on the timeline for its review.” The vaccine made by BioNTech and Pfizer became the first to be granted emergency authorization in Britain last week, and in Canada on Wednesday. The US FDA is expected to consider a submission for approval on Thursday.

It would not be the first time an entity linked with coronavirus vaccines has been targeted by cybercriminals.

Last month, Microsoft said it had detected attempts by state-backed Russian and North Korean hackers to steal valuable data from leading pharmaceutical companies and vaccine researchers.

Microsoft said most of the targets — located in Canada, France, India, South Korea and the United States — were “directly involved in researching vaccines and treatments for COVID-19". It did not name the targets but said most had vaccine candidates in various stages of clinical trials.