The target was a Philadelphia company that sells software used in hundreds of clinical trials, according to the New York Times.
No patients were affected.
The attack on eResearchTechnology (ERT) began two weeks ago when employees discovered they were locked out of their data by ransomware.
The companies hit were IQVIA, a contract research organization helping to manage AstraZeneca’s Covid vaccine trial, and Bristol Myers Squibb, which is leading a consortium of companies to develop a quick test for the virus.
ERT has not said how many clinical trials were affected.
The company was involved in three-quarters of trials that led to drug approvals by the Food and Drug Administration last year, according to its website.
On Friday, Drew Bustos, ERT’s vice president of marketing, confirmed that ransomware had seized its systems Sept. 20.
As a precaution, Bustos said, the company took its systems offline that day and notified outside cybersecurity experts as well as the FBI.
The company said it was too early to say who was behind the attack.
A spokesman declined to say whether the company paid its extortionists.
The incidents followed more than 1,000 ransomware attacks on U.S. cities, counties and hospitals over the past 18 months, according to the Times.