MSD
Company Details
Linkedin ID:
msd-global
Website:
Employees number:
40,830
Number of followers:
1,160,753
NAICS:
3254
Industry Type:
Homepage:
msd.com
IP Addresses:
0
Company ID:
MSD_2025770
Scan Status:
In-progress
Internal validation & live display
Multiple badges & continuous verification
Faster underwriting decisions
MSD Vendor Cyber Rating & Cyber Score
msd.comAt MSD, known as Merck & Co., Inc., Rahway, NJ, USA in the United States and Canada, we are unified around our purpose: We use the power of leading-edge science to save and improve lives around the world. For more than 130 years, we have brought hope to humanity through the development of important medicines and vaccines. We aspire to be the premier research-intensive biopharmaceutical company in the world – and today, we are at the forefront of research to deliver innovative health solutions that advance the prevention and treatment of diseases in people and animals. We foster a diverse and inclusive global workforce and operate responsibly every day to enable a safe, sustainable and healthy future for all people and communities. For more information, visit www.msd.com and connect with us on Facebook, Instagram, Twitter, and YouTube.
MSD A.I CyberSecurity Scoring
MSD Risk Score (AI oriented)Between 750 and 799
MSD
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
MSD Global Score (TPRM)XXXX
MSD
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
MSD Company CyberSecurity News & History
Past Incidents
1
Attack Types
1
Merck Sharpe & Dohme LLC
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: In September 2025, Merck Sharpe & Dohme LLC experienced a data breach via its third-party service provider, Graebel Companies Inc., which manages employee relocation services. Unauthorized access to Graebel’s systems exposed sensitive personally identifiable information (PII) of current and former Merck employees. The compromised data includes names, dates of birth, addresses, phone numbers, Social Security numbers, and financial account details. Merck confirmed the breach after an internal review and reported it to the Massachusetts Attorney General’s office in November 2025. Affected individuals were notified, and the company offered free identity theft protection services (Cyberscout) to mitigate risks. The full scope of the breach remains undetermined but is potentially significant, with legal firms investigating compensation claims for victims, including reimbursement for financial losses, time spent resolving issues, and emotional distress.
MSD Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for MSD
Incidents vs Pharmaceutical Manufacturing Industry Average (This Year)
No incidents recorded for MSD in 2026.
Incidents vs All-Companies Average (This Year)
No incidents recorded for MSD in 2026.
Incident Types MSD vs Pharmaceutical Manufacturing Industry Avg (This Year)
No incidents recorded for MSD in 2026.
Incident History — MSD (X = Date, Y = Severity)
MSD cyber incidents detection timeline including parent company and subsidiaries
MSD Company Subsidiaries
At MSD, known as Merck & Co., Inc., Rahway, NJ, USA in the United States and Canada, we are unified around our purpose: We use the power of leading-edge science to save and improve lives around the world. For more than 130 years, we have brought hope to humanity through the development of important medicines and vaccines. We aspire to be the premier research-intensive biopharmaceutical company in the world – and today, we are at the forefront of research to deliver innovative health solutions that advance the prevention and treatment of diseases in people and animals. We foster a diverse and inclusive global workforce and operate responsibly every day to enable a safe, sustainable and healthy future for all people and communities. For more information, visit www.msd.com and connect with us on Facebook, Instagram, Twitter, and YouTube.
Loading...
MSD Similar Companies
Merck Group
This channel is not intended for U.S. and Canadian visitors. Merck operates in the U.S. and Canada as EMD Serono in Healthcare, MilliporeSigma in Life Science and EMD Electronics in Electronics. An unaffiliated and unrelated company, Merck & Co., Inc., Kenilworth, NJ, US holds the rights in the trad
Parexel
Parexel is a leading global clinical research organization (CRO) providing insights-driven Clinical and Consulting solutions to the world’s life sciences industry. Leveraging deep local knowledge and a global breadth of clinical, regulatory and therapeutic expertise, our 24,000+ professionals worldw
Eli Lilly and Company
We're a medicine company turning science into healing to make life better for people around the world. It all started nearly 150 years ago with a clear vision from founder Colonel Eli Lilly: "Take what you find here and make it better and better." Harnessing the power of biotechnology, chemistry and
Lupin
Lupin Limited is a global pharmaceutical leader headquartered in Mumbai, India, with products distributed in over 100 markets. Lupin specializes in pharmaceutical products, including branded and generic formulations, complex generics, biotechnology products, and active pharmaceutical ingredients. Tr
Zydus Group
The Zydus Group with an overarching purpose of empowering people with freedom to live healthier and more fulfilled lives, is an innovative, global life-sciences company that discovers, develops, manufactures, and markets a broad range of healthcare therapies. The group employs over 27000 people worl
At Bristol Myers Squibb, we work every day to transform patients’ lives through science. That work inspires some of the most interesting, meaningful, and life-changing careers you’ll experience. Join us and pursue innovative ideas alongside some of the brightest minds in biopharma, collaborating wit
At Johnson & Johnson Innovative Medicine, we innovate with purpose, to lead where medicine is going. The experiences of patients around the world inform and inspire our science-based innovations, which continue to change and save lives. Applying rigorous science with compassion, we confidently addre
AUROBINDO PHARMA LTD
Aurobindo Pharma Limited (NSE: AUROPHARMA, BSE: 524804, Reuters: ARBN.NS, Bloomberg: ARBP IN) is an integrated global pharmaceutical company headquartered in Hyderabad, India. The Company develops, manufactures, and markets a wide range of generic pharmaceuticals, branded specialty drugs, and active
Intas Pharmaceuticals
Intas is one of the leading multinational pharmaceutical formulation development, manufacturing, and marketing organization in the world. It has been growing at 19% CAGR and crossed the $2.5 billion mark in the past financial year. The company has set up a network of subsidiaries, under the name Acc
.png)
MSD CyberSecurity News
March 24, 2026 07:00 AM
AstraZeneca reportedly hit by serious cyberattack
A hacking group claims to have broken into AstraZeneca's IT systems and stolen confidential data, which they are now offering for sale.
March 06, 2026 08:00 AM
NOBLIS MSD WINS $151 MILLION IN U.S. NAVY CONTRACTS TO SUPPORT WARSHIP MODERNIZATION
Work will drive next-generation control systems and cybersecurity for Navy destroyers. Advertisement. Reston, Va., March 05,...
December 10, 2025 08:00 AM
No, pensioners aren't getting a Christmas bonus
Superannuitants are being warned not to fall for a new scam.
December 08, 2025 08:00 AM
NOBLIS MSD AWARDED $45 MILLION CONTRACT TO ADVANCE NAVY
Work will drive next-generation control systems and cybersecurity for Navy amphibious warfare ships...
December 08, 2025 08:00 AM
Noblis MSD awarded $45m US Navy engineering contract
Noblis MSD has been awarded a $45 million contract to provide advanced engineering and cybersecurity services for the US Navy's Naval...
October 08, 2025 07:00 AM
Industrial Cyber Security Event 2025
On Wednesday, October 8, ICT Group will be present at the FHI Industrial Cyber Security event at the 1931 Conference Center in Den Bosch.
September 30, 2025 07:00 AM
From Defense to Resilience: Where School Cybersecurity Goes Next
The future of cybersecurity in schools is to build resilience. As one district IT director puts it, “we're asking how we can get in front of...
September 23, 2025 07:00 AM
Event summary — CEE Her Workshop in Prague: Technology-Driven Security and Resilience
From September 10 to 12, 2025, GLOBSEC's CEE Her Workshop hosted its sixth edition in Prague, Czech Republic. This edition brought together...
September 08, 2025 07:09 AM
Jonathan “Joe” Owen
Jonathan “Joe” Owen was the Acting Deputy Assistant Secretary of Defense for Homeland Defense Integration and Defense Support to Civil Authorities.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
MSD CyberSecurity History Information
Official Website of MSD
The official website of MSD is http://www.msd.com.
MSD’s AI-Generated Cybersecurity Score
According to Rankiteo, MSD’s AI-generated cybersecurity score is 766, reflecting their Fair security posture.
How many security badges does MSD’ have ?
According to Rankiteo, MSD currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has MSD been affected by any supply chain cyber incidents ?
According to Rankiteo, MSD has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
Does MSD have SOC 2 Type 1 certification ?
According to Rankiteo, MSD is not certified under SOC 2 Type 1.
Does MSD have SOC 2 Type 2 certification ?
According to Rankiteo, MSD does not hold a SOC 2 Type 2 certification.
Does MSD comply with GDPR ?
According to Rankiteo, MSD is not listed as GDPR compliant.
Does MSD have PCI DSS certification ?
According to Rankiteo, MSD does not currently maintain PCI DSS compliance.
Does MSD comply with HIPAA ?
According to Rankiteo, MSD is not compliant with HIPAA regulations.
Does MSD have ISO 27001 certification ?
According to Rankiteo,MSD is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of MSD
MSD operates primarily in the Pharmaceutical Manufacturing industry.
Number of Employees at MSD
MSD employs approximately 40,830 people worldwide.
Subsidiaries Owned by MSD
MSD presently has no subsidiaries across any sectors.
MSD’s LinkedIn Followers
MSD’s official LinkedIn profile has approximately 1,160,753 followers.
NAICS Classification of MSD
MSD is classified under the NAICS code 3254, which corresponds to Pharmaceutical and Medicine Manufacturing.
MSD’s Presence on Crunchbase
No, MSD does not have a profile on Crunchbase.
MSD’s Presence on LinkedIn
Yes, MSD maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/msd-global.
Cybersecurity Incidents Involving MSD
As of April 04, 2026, Rankiteo reports that MSD has experienced 1 cybersecurity incidents.
Number of Peer and Competitor Companies
MSD has an estimated 5,608 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at MSD ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
How does MSD detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with cyberscout (identity theft protection services), and containment measures with system access restrictions (by graebel), and recovery measures with notifications to affected individuals, recovery measures with free identity theft protection services (cyberscout), and communication strategy with direct mailing to affected individuals, communication strategy with public disclosure via massachusetts attorney general’s office, communication strategy with legal advisories via shamis & gentile p.a...
Incident Details
Can you provide details on each incident ?
Title: Merck Sharpe & Dohme LLC Data Breach via Graebel Companies Inc.
Description: Merck Sharpe & Dohme LLC, a multinational pharmaceutical company, experienced a data breach through its U.S.-based service provider, Graebel Companies Inc., which handles employee relocation management services. Unauthorized access to Graebel's systems exposed sensitive personally identifiable information (PII) of current and former Merck employees. The breach was detected in September 2025, with Merck completing its review by October 20, 2025. Notifications were sent to affected individuals, and the incident was reported to the Massachusetts Attorney General’s office on November 17, 2025. The full extent of the breach is not yet known but is potentially significant.
Date Detected: 2025-09
Date Publicly Disclosed: 2025-11-17
Type: data breach
Attack Vector: unauthorized accesssupply chain compromise
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : data breach MSD0602706111825
Systems Affected: Graebel Companies Inc. systems
Brand Reputation Impact: potential (ongoing investigation)
Legal Liabilities: potential (class action lawsuits initiated)
Identity Theft Risk: high (PII exposed)
Payment Information Risk: high (financial account information exposed)
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (Pii), Financial Account Information and .
Which entities were affected by each incident ?
Incident : data breach MSD0602706111825
Entity Name: Merck Sharpe & Dohme LLC
Entity Type: pharmaceutical company
Industry: healthcare/pharmaceuticals
Location: Rahway, New Jersey, USA
Size: multinational (large)
Incident : data breach MSD0602706111825
Entity Name: Graebel Companies Inc.
Entity Type: service provider
Industry: employee relocation management
Location: USA
Customers Affected: current and former Merck employees
Response to the Incidents
What measures were taken in response to each incident ?
Incident : data breach MSD0602706111825
Incident Response Plan Activated: True
Third Party Assistance: Cyberscout (Identity Theft Protection Services).
Containment Measures: system access restrictions (by Graebel)
Recovery Measures: notifications to affected individualsfree identity theft protection services (Cyberscout)
Communication Strategy: direct mailing to affected individualspublic disclosure via Massachusetts Attorney General’s officelegal advisories via Shamis & Gentile P.A.
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Cyberscout (identity theft protection services), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : data breach MSD0602706111825
Type of Data Compromised: Personally identifiable information (pii), Financial account information
Sensitivity of Data: high
Data Exfiltration: likely (under investigation)
Personally Identifiable Information: namedate of birthaddressphone numberSocial Security number
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by system access restrictions (by graebel) and .
Ransomware Information
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through notifications to affected individuals, free identity theft protection services (Cyberscout), .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : data breach MSD0602706111825
Legal Actions: class action lawsuits (investigated by Shamis & Gentile P.A.),
Regulatory Notifications: Massachusetts Attorney General’s office (reported on 2025-11-17)
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through class action lawsuits (investigated by Shamis & Gentile P.A.), .
Lessons Learned and Recommendations
What recommendations were made to prevent future incidents ?
Incident : data breach MSD0602706111825
Recommendations: Monitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibilityMonitor financial accounts for suspicious activity, Sign up for free Cyberscout identity theft protection services, Place a fraud alert with credit bureaus, Request free annual credit reports, Seek legal counsel for compensation eligibility
References
Where can I find more information about each incident ?
Incident : data breach MSD0602706111825
Source: Shamis & Gentile P.A. (class action investigation)
Incident : data breach MSD0602706111825
Source: Massachusetts Attorney General’s office (breach notification)
Date Accessed: 2025-11-17
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Shamis & Gentile P.A. (class action investigation), and Source: Massachusetts Attorney General’s office (breach notification)Date Accessed: 2025-11-17.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : data breach MSD0602706111825
Investigation Status: ongoing (full extent of breach not yet known)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Direct Mailing To Affected Individuals, Public Disclosure Via Massachusetts Attorney General’S Office and Legal Advisories Via Shamis & Gentile P.A..
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : data breach MSD0602706111825
Stakeholder Advisories: Notifications Mailed To Affected Individuals.
Customer Advisories: Free identity theft protection (Cyberscout)Fraud alert and credit report recommendationsLegal compensation eligibility
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Notifications Mailed To Affected Individuals, Free Identity Theft Protection (Cyberscout), Fraud Alert And Credit Report Recommendations, Legal Compensation Eligibility and .
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : data breach MSD0602706111825
High Value Targets: Employee Pii And Financial Data,
Data Sold on Dark Web: Employee Pii And Financial Data,
Post-Incident Analysis
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Cyberscout (Identity Theft Protection Services), .
Additional Questions
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2025-09.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-11-17.
Impact of the Incidents
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was Graebel Companies Inc. systems.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was cyberscout (identity theft protection services), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was system access restrictions (by Graebel).
Data Breach Information
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was class action lawsuits (investigated by Shamis & Gentile P.A.), .
Lessons Learned and Recommendations
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Sign up for free Cyberscout identity theft protection services, Monitor financial accounts for suspicious activity, Seek legal counsel for compensation eligibility, Place a fraud alert with credit bureaus and Request free annual credit reports.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Shamis & Gentile P.A. (class action investigation) and Massachusetts Attorney General’s office (breach notification).
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (full extent of breach not yet known).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was notifications mailed to affected individuals, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued was an Free identity theft protection (Cyberscout)Fraud alert and credit report recommendationsLegal compensation eligibility.
.png)
Latest Global CVEs (Not Company-Specific)
Description
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.
Risk Information
cvss3
Base: 5.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
Risk Information
cvss3
Base: 8.6
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Description
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.
Risk Information
cvss3
Base: 9.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage. This issue has been patched in version 4.5.90.
Risk Information
cvss3
Base: 6.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=msd-global' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
