Company Details
msd-global
35,519
1,133,621
3254
msd.com
0
MSD_2025770
In-progress

MSD Company CyberSecurity Posture
msd.comAt MSD, known as Merck & Co., Inc., Rahway, NJ, USA in the United States and Canada, we are unified around our purpose: We use the power of leading-edge science to save and improve lives around the world. For more than 130 years, we have brought hope to humanity through the development of important medicines and vaccines. We aspire to be the premier research-intensive biopharmaceutical company in the world – and today, we are at the forefront of research to deliver innovative health solutions that advance the prevention and treatment of diseases in people and animals. We foster a diverse and inclusive global workforce and operate responsibly every day to enable a safe, sustainable and healthy future for all people and communities. For more information, visit www.msd.com and connect with us on Facebook, Instagram, Twitter, and YouTube.
Company Details
msd-global
35,519
1,133,621
3254
msd.com
0
MSD_2025770
In-progress
Between 750 and 799

MSD Global Score (TPRM)XXXX

Description: In September 2025, Merck Sharpe & Dohme LLC experienced a data breach via its third-party service provider, Graebel Companies Inc., which manages employee relocation services. Unauthorized access to Graebel’s systems exposed sensitive personally identifiable information (PII) of current and former Merck employees. The compromised data includes names, dates of birth, addresses, phone numbers, Social Security numbers, and financial account details. Merck confirmed the breach after an internal review and reported it to the Massachusetts Attorney General’s office in November 2025. Affected individuals were notified, and the company offered free identity theft protection services (Cyberscout) to mitigate risks. The full scope of the breach remains undetermined but is potentially significant, with legal firms investigating compensation claims for victims, including reimbursement for financial losses, time spent resolving issues, and emotional distress.


MSD has 25.0% more incidents than the average of same-industry companies with at least one recorded incident.
MSD has 29.87% more incidents than the average of all companies with at least one recorded incident.
MSD reported 1 incidents this year: 0 cyber attacks, 0 ransomware, 0 vulnerabilities, 1 data breaches, compared to industry peers with at least 1 incident.
MSD cyber incidents detection timeline including parent company and subsidiaries

At MSD, known as Merck & Co., Inc., Rahway, NJ, USA in the United States and Canada, we are unified around our purpose: We use the power of leading-edge science to save and improve lives around the world. For more than 130 years, we have brought hope to humanity through the development of important medicines and vaccines. We aspire to be the premier research-intensive biopharmaceutical company in the world – and today, we are at the forefront of research to deliver innovative health solutions that advance the prevention and treatment of diseases in people and animals. We foster a diverse and inclusive global workforce and operate responsibly every day to enable a safe, sustainable and healthy future for all people and communities. For more information, visit www.msd.com and connect with us on Facebook, Instagram, Twitter, and YouTube.


At Janssen, we never stop working toward a future where disease is a thing of the past. We’re the Pharmaceutical Companies of Johnson & Johnson, and you can count on us to keep working tirelessly to make that future a reality for patients everywhere, by fighting sickness with science, improving ac
At Teva, we're proud to be a different kind of global pharmaceutical leader, one that operates across the full spectrum of innovation to reliably deliver medicines to patients worldwide. For over 120 years, our commitment to bettering health has never wavered. Every day, we challenge ourselves to p
EMS is the leading pharmaceutical company in Brazil. Established since 45 years and with 100% national capital, the company has two industrial plants strategically placed in São Bernardo do Campo and Hortolândia, in the state of São Paulo. With a work based on daring, simplicity, excellence and res

Astellas is a global life sciences company committed to turning innovative science into VALUE for patients. We provide transformative therapies in disease areas that include oncology, ophthalmology, urology, immunology and women's health. Through our research and development programs, we are pioneer

Viatris Inc. (NASDAQ: VTRS) is a global healthcare company uniquely positioned to bridge the traditional divide between generics and brands, combining the best of both to more holistically address healthcare needs globally. With a mission to empower people worldwide to live healthier at every stage

Established in 1966, PT Kalbe Farma Tbk. (“the Company” or “Kalbe”) has gone a long way from its humble beginnings as a garage-operated pharmaceutical business in North Jakarta. It has expanded by strategic acquisitions of pharmaceutical companies, building a leading brand positioning and reaching t

At Johnson & Johnson Innovative Medicine, we innovate with purpose, to lead where medicine is going. The experiences of patients around the world inform and inspire our science-based innovations, which continue to change and save lives. Applying rigorous science with compassion, we confidently addre

Sandoz is the global leader in generic and biosimilar medicines. Our Purpose is to pioneer access to medicines for patients globally. We are on a mission to drive innovation in the healthcare industry by freeing up resources sustainably and responsibly while continuing to address global health c

Established in 1907, Alembic Pharmaceuticals Limited is a leading pharmaceutical company in India. The Company is vertically integrated with the ability to develop, manufacture and market pharmaceutical products, pharmaceutical substances and Intermediates. Alembic is the market leader in the Macrol
.png)
From semiconductors to advanced cybersecurity and AI, there are many exciting opportunities for skilled professionals in the deep-tech space...
ICT Group will be present at the FHI Industrial Cyber Security event at the 1931 Conference Center in Den Bosch. This event offers practical insights into the...
In Ireland and further afield there are a number of exciting organisations looking to add to their teams across a range of sectors.
The future of cybersecurity in schools is to build resilience. As one district IT director puts it, “we're asking how we can get in front of...
From September 10 to 12, 2025, GLOBSEC's CEE Her Workshop hosted its sixth edition in Prague, Czech Republic. This edition brought together...
Generative AI has weaponized phishing,” one IT director says. “Even seasoned staff can't always tell the difference.”
Hi, it's Liana Baker in New York, catching up with the CEO of a cybersecurity startup. Also today, communications firm Teneo gets a new...
Acrisure has entered into a definitive agreement to issue new convertible senior preferred stock in a US$2.1 billion capital raise, with the round led by Bain...
Acrisure, a global FinTech company delivering tech-powered financial services to businesses and individuals, has raised $2.1bn through a new issuance of...

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of MSD is http://www.msd.com.
According to Rankiteo, MSD’s AI-generated cybersecurity score is 760, reflecting their Fair security posture.
According to Rankiteo, MSD currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, MSD is not certified under SOC 2 Type 1.
According to Rankiteo, MSD does not hold a SOC 2 Type 2 certification.
According to Rankiteo, MSD is not listed as GDPR compliant.
According to Rankiteo, MSD does not currently maintain PCI DSS compliance.
According to Rankiteo, MSD is not compliant with HIPAA regulations.
According to Rankiteo,MSD is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
MSD operates primarily in the Pharmaceutical Manufacturing industry.
MSD employs approximately 35,519 people worldwide.
MSD presently has no subsidiaries across any sectors.
MSD’s official LinkedIn profile has approximately 1,133,621 followers.
MSD is classified under the NAICS code 3254, which corresponds to Pharmaceutical and Medicine Manufacturing.
No, MSD does not have a profile on Crunchbase.
Yes, MSD maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/msd-global.
As of December 11, 2025, Rankiteo reports that MSD has experienced 1 cybersecurity incidents.
MSD has an estimated 5,412 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with cyberscout (identity theft protection services), and containment measures with system access restrictions (by graebel), and recovery measures with notifications to affected individuals, recovery measures with free identity theft protection services (cyberscout), and communication strategy with direct mailing to affected individuals, communication strategy with public disclosure via massachusetts attorney general’s office, communication strategy with legal advisories via shamis & gentile p.a...
Title: Merck Sharpe & Dohme LLC Data Breach via Graebel Companies Inc.
Description: Merck Sharpe & Dohme LLC, a multinational pharmaceutical company, experienced a data breach through its U.S.-based service provider, Graebel Companies Inc., which handles employee relocation management services. Unauthorized access to Graebel's systems exposed sensitive personally identifiable information (PII) of current and former Merck employees. The breach was detected in September 2025, with Merck completing its review by October 20, 2025. Notifications were sent to affected individuals, and the incident was reported to the Massachusetts Attorney General’s office on November 17, 2025. The full extent of the breach is not yet known but is potentially significant.
Date Detected: 2025-09
Date Publicly Disclosed: 2025-11-17
Type: data breach
Attack Vector: unauthorized accesssupply chain compromise
Common Attack Types: The most common types of attacks the company has faced is Breach.

Systems Affected: Graebel Companies Inc. systems
Brand Reputation Impact: potential (ongoing investigation)
Legal Liabilities: potential (class action lawsuits initiated)
Identity Theft Risk: high (PII exposed)
Payment Information Risk: high (financial account information exposed)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (Pii), Financial Account Information and .

Entity Name: Merck Sharpe & Dohme LLC
Entity Type: pharmaceutical company
Industry: healthcare/pharmaceuticals
Location: Rahway, New Jersey, USA
Size: multinational (large)

Entity Name: Graebel Companies Inc.
Entity Type: service provider
Industry: employee relocation management
Location: USA
Customers Affected: current and former Merck employees

Incident Response Plan Activated: True
Third Party Assistance: Cyberscout (Identity Theft Protection Services).
Containment Measures: system access restrictions (by Graebel)
Recovery Measures: notifications to affected individualsfree identity theft protection services (Cyberscout)
Communication Strategy: direct mailing to affected individualspublic disclosure via Massachusetts Attorney General’s officelegal advisories via Shamis & Gentile P.A.
Third-Party Assistance: The company involves third-party assistance in incident response through Cyberscout (identity theft protection services), .

Type of Data Compromised: Personally identifiable information (pii), Financial account information
Sensitivity of Data: high
Data Exfiltration: likely (under investigation)
Personally Identifiable Information: namedate of birthaddressphone numberSocial Security number
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by system access restrictions (by graebel) and .
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through notifications to affected individuals, free identity theft protection services (Cyberscout), .

Legal Actions: class action lawsuits (investigated by Shamis & Gentile P.A.),
Regulatory Notifications: Massachusetts Attorney General’s office (reported on 2025-11-17)
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through class action lawsuits (investigated by Shamis & Gentile P.A.), .

Recommendations: Monitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibility

Source: Shamis & Gentile P.A. (class action investigation)

Source: Massachusetts Attorney General’s office (breach notification)
Date Accessed: 2025-11-17
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Shamis & Gentile P.A. (class action investigation), and Source: Massachusetts Attorney General’s office (breach notification)Date Accessed: 2025-11-17.

Investigation Status: ongoing (full extent of breach not yet known)
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Direct Mailing To Affected Individuals, Public Disclosure Via Massachusetts Attorney General’S Office and Legal Advisories Via Shamis & Gentile P.A..

Stakeholder Advisories: Notifications Mailed To Affected Individuals.
Customer Advisories: Free identity theft protection (Cyberscout)Fraud alert and credit report recommendationsLegal compensation eligibility
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Notifications Mailed To Affected Individuals, Free Identity Theft Protection (Cyberscout), Fraud Alert And Credit Report Recommendations, Legal Compensation Eligibility and .

High Value Targets: Employee Pii And Financial Data,
Data Sold on Dark Web: Employee Pii And Financial Data,
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cyberscout (Identity Theft Protection Services), .
Most Recent Incident Detected: The most recent incident detected was on 2025-09.
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-11-17.
Most Significant System Affected: The most significant system affected in an incident was Graebel Companies Inc. systems.
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cyberscout (identity theft protection services), .
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was system access restrictions (by Graebel).
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was class action lawsuits (investigated by Shamis & Gentile P.A.), .
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Monitor financial accounts for suspicious activity, Request free annual credit reports, Place a fraud alert with credit bureaus, Sign up for free Cyberscout identity theft protection services and Seek legal counsel for compensation eligibility.
Most Recent Source: The most recent source of information about an incident are Massachusetts Attorney General’s office (breach notification) and Shamis & Gentile P.A. (class action investigation).
Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (full extent of breach not yet known).
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was notifications mailed to affected individuals, .
Most Recent Customer Advisory: The most recent customer advisory issued was an Free identity theft protection (Cyberscout)Fraud alert and credit report recommendationsLegal compensation eligibility.
.png)
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.