Sixteen years of development and innovation have been brought to a halt in the most high-tech way possible. The U.S.-based company Crystal Pharmatech has fallen victim to a large-scale cyberattack. According to cyber intelligence reports, more than 200 GB of corporate data has been compromised and encrypted. And the consequences could extend far beyond a single company. Judging by the files that have already appeared on the dark web, many clients may have questions for the company - including the notoriously controversial AstraZeneca.

Crystal Pharmatech was founded in 2010 in Suzhou, China. It specializes in a field that patients never think about, but without which many drugs would never have become drugs: solid-state chemistry. The company researches the crystalline form in which the active ingredient exists, how to obtain the desired form, and how to control crystallization, solubility, and stability.

Over the years, Crystal Pharmatech has evolved from a niche solid-state CRO into a broader CRO/CDMO platform. Today, its headquarters are located in New Jersey (U.S.). The company reports having approximately 300 employees, four R&D centers in the U.S., Canada, and China, more than 2,000 clients, and over 4,000 projects. The company also claims that its scientific leadership has participated in the development of more than 100 NCEs and 15 pharmaceutical products. This is a typical example of pharmaceutical globalization: American clients, a Chinese R&D and manufacturing base, and international R&D processes.

The company announced that by the end of 2026, the capacity of its Chinese facility is expected to exceed 500 kg, including equipment for large-scale production of amorphous solid dispersions and commercial mixers with a capacity of over 1,000 liters. In June 2026, the company officially announced the consolidation of its business under the Crystal Group brand. The group includes Crystal Pharmatech, Crystal Bio Solutions, and Crystal NAX - platforms for small molecules, biologics, and nucleic acid technologies, respectively.

Financial reports for this privately held group are not publicly available, so it is not possible to estimate exact revenue and profit figures. Previously, Crystal Pharmatech raised $1.48 million in angel funding, $10 million in Series A funding, and $14.5 million in Series B funding. Third-party databases provide only model estimates of the business’s value ($58–87 million). But another indicator is far more telling: Suzhou Industrial Park reported that the company’s operating revenue grew by approximately 70% year-over-year.

But it appears that the company’s growth story has come to an end. Monitoring sites have detected a cyberattack on the company. The volume of data stolen is staggering - more than 200 GB of corporate information. The files contain commercial contracts, research results, formulas and recipes, invoices, personal data, and internal documentation. This changes the scale of the cyber incident. We are no longer talking about a digital vault containing accounting records, but rather a potential archive of third-party pharmaceutical developments.

Among the documents reviewed, some are particularly revealing. In July 2021, Crystal signed a Change Order with Sage Therapeutics regarding the SAGE-319 project. The price for the additional work was $60,000 for ten FTE-weeks. The objective: to understand the origin of known solid forms and optimize the conditions for their isolation. This is no longer just a marketing brochure. This is a specific commercial transaction involving a specific drug candidate. 

Another confidential document is a reciprocal confidentiality agreement with AstraZeneca from 2019. Its subject is proposed collaboration on crystallization and solid-state research.


And in the laboratory documentation for another project, we find batch numbers, suppliers, internal codes, solvents, buffers, surfactants, and cyclodextrins.

If the data set does indeed contain documents from AstraZeneca, Sage, or other pharmaceutical companies, Crystal turns out to be not only the victim but also a potential trigger for a chain reaction. Clients may demand an investigation, suspend new projects, conduct an audit, or file claims under confidentiality agreements.

Interestingly, as of the time of publication, no official statement regarding a ransomware attack or data breach has been found on the Crystal Pharmatech website. At the same time, in its current privacy policy, the company promises to use access controls, authentication, monitoring, and vulnerability checks, and also states that it has safeguards in place for international data transfers.

If the company has indeed suffered a serious breach, sooner or later it will have to answer questions far more complex than “was there a virus?” Which systems were compromised? Were research results stolen? Were GxP records affected? How is data integrity ensured? So far, there has been no public response to these questions.

However, Crystal Pharmatech’s website currently lists an opening for a Senior IT Systems Specialist in Pleasanton, California. The salary is listed at $90,000–120,000 per year. The company is looking for someone to identify infrastructure vulnerabilities, address the root causes of problems, and conduct backup recovery testing. Against the backdrop of public reports about the ransomware incident, this job posting almost seems like a documentary detail from the post-breach era.

But why station a guard in front of an open safe - especially if everything has already been stolen from it? For a pharmaceutical company, a leak of a lab log is sometimes more dangerous than a leak of an accounting ledger. The accounting department reveals how much the company has spent. The laboratory archive can reveal exactly what the company knows. And in the pharmaceutical industry, knowledge is an asset that is sometimes worth more than the factory itself.

DATE FOR ANALYSIS PROVIDED BY QILIN