Orifarm Group A/S

Denmark · owned by HBS Capital ApS (Denmark) · orifarm.com · 35 vendors

Orifarm creates access to great healthcare products by supplying wholesalers, pharmacies, hospitals, and patients with a wide range of pharmaceuticals. The company sources pharmaceuticals at lower costs and provides established household brands to make healthcare more affordable.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-13 · revision 15

35 direct vendors, 372 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Orifarm Group A/S exhibits a medium level of migration readiness. The company's strong financial stability, evidenced by consistent revenue growth, provides a solid foundation to fund significant migration initiatives. The existing adoption of cloud services like Microsoft Azure, Microsoft 365, and SAP SuccessFactors indicates a familiarity with cloud environments and a capability to integrate cloud solutions. While the 'Total Vendors: 0' is noted as a data anomaly, the presence of 'Total Services: 51' and vendor relationships spanning 10 unique countries suggests a diverse vendor landscape, which can reduce vendor lock-in compared to a highly concentrated vendor base. However, several factors present significant challenges to migration. The core ERP system, SAP, can be complex and costly to migrate, often representing a monolithic architecture. There is no explicit mention of modern architectural patterns like containerization or microservices, which would typically indicate higher readiness for cloud-native migration. The regulatory environment is highly complex and critical for a pharmaceutical company operating across 16 markets. The 'Assessment Required' status for GDPR, NIS2, EU GMP, and EU GDP, coupled with stringent data residency requirements (EU/EEA, national health data laws, US operations), will necessitate meticulous planning and potentially limit architectural choices during migration to ensure continuous compliance. The unknown vendor lock-in risk also adds an element of uncertainty to migration planning. The complexity of managing 51 services from diverse vendors during a migration could also be a logistical challenge.

Compliance

13 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

ISO 27001 risk is Medium for Orifarm because: (1) As a large pharmaceutical company with ~2,300 employees operating across 17 countries, Orifarm manages significant information assets including proprietary pharmaceutical formulations, patient safety data, commercial contracts, and supply chain data. (2) ISO 27001 is not legally mandatory but is strongly recommended — and increasingly expected — for pharmaceutical companies of this scale, particularly given NIS2 obligations (which reference ISO 27001-aligned controls). (3) No ISO 27001 certification was found in public sources, which represents a gap for a company of this size and regulatory complexity. (4) The risk is Medium rather than High because ISO 27001 is voluntary; however, the absence of certification increases NIS2 compliance risk and may affect customer/partner trust. (5) Orifarm's GMP/GDP compliance framework demonstrates a quality management culture, but information security management is a distinct discipline requiring dedicated ISMS implementation.

Evidence: https://www.orifarm.com/about-us/high-product-quality/, https://www.orifarm.com/about-us/

EU Good Distribution Practice — Compliant

GDP risk is Medium because: (1) Orifarm explicitly states GDP compliance and holds wholesale distribution licenses across 16 markets. (2) GDP compliance is verified through regular inspections by national health authorities. (3) Orifarm's supplier qualification system and temperature monitoring on transport routes demonstrate active GDP management. (4) Risk remains Medium due to the complexity of maintaining GDP compliance across 16 markets with different national implementations, and the ongoing nature of GDP obligations (cold chain management, falsified medicine prevention, recall procedures).

Evidence: https://www.orifarm.com/about-us/high-product-quality/

Danish Data Protection Act — Partially Compliant

Danish DPA risk is High because: (1) As a Danish-headquartered company, Orifarm is subject to the Danish Data Protection Act which supplements GDPR with national-specific requirements. (2) The Danish Datatilsynet (Data Protection Authority) is the lead supervisory authority for Orifarm's EU-wide GDPR compliance as the company's main establishment is in Denmark. (3) Danish-specific requirements include stricter rules on processing of CPR numbers (civil registration numbers), employee monitoring, and certain sensitive data categories. (4) Datatilsynet has been an active enforcement authority, issuing fines and reprimands to Danish companies. (5) The risk is High because Orifarm processes employee data (including potentially CPR numbers for payroll), customer data, and health-related adverse event data — all areas of heightened Danish DPA scrutiny.

Evidence: https://www.orifarm.com/privacy-policies/, https://www.orifarm.com/privacy-policies/denmark-privatlivspolitik/

Financials

Three-year financials

Financial Resilience Score: 6/10

Orifarm Group A/S demonstrates solid financial resilience underpinned by its position as Europe's largest parallel importer of pharmaceuticals, a diversified three-platform business model (Pharma Trade, Specialty Rx, Consumer Healthcare), and long-term stable family ownership by the Bøgh-Sørensen family. Revenue has grown at approximately 14% CAGR from 2018 to 2024, reaching €1.82B, with EBITDA nearly doubling from 2022 to 2024 (€118.9M in 2024 vs. €61M operating profit in 2022), indicating that the post-Takeda integration is now translating into meaningful profitability improvement. The company operates across 15+ sales markets and 30 purchase markets, providing sourcing arbitrage and geographic diversification within Europe. However, structural weaknesses temper the score. Operating margins remain thin at ~4-6.5%, typical for distribution-heavy pharma but leaving limited buffer against shocks. The debt-funded 2021 Takeda acquisition drove the equity ratio down from ~40% (2019) to 15-16% (2021-2022), materially increasing leverage. Regulatory risk is significant since the parallel-import model depends on EU price differentials that could be squeezed by manufacturer pricing harmonisation or regulatory changes. FX exposure, cost inflation, and post-acquisition integration issues (acknowledged supply issues in 2022, Skælskør site closure completed 2023) add further complexity. Concentration in Europe with minimal US presence limits diversification, and rising CSRD/ESG scrutiny presents compliance costs going forward.

Key strengths: Market leadership as Europe's largest parallel importer of pharmaceuticals, Diversified three-platform model post-Takeda acquisition (110+ brands), Long-term stable family ownership by Bøgh-Sørensen family, Revenue CAGR ~14% from 2018 to 2024, EBITDA nearly doubled from 2022 to 2024 (€118.9M in 2024), Broad geographic footprint: 15 sales markets, 30 purchase markets, 5 production sites, 83.4 million packs sold annually, 4,500+ marketing authorisations, Rising corporate tax contribution (€14.3M in 2024) indicates improving profitability

Risk factors: Regulatory/patent risk from EU free-movement rules and manufacturer pricing harmonisation, Thin operating margins (~4-6.5%) provide limited buffer, Elevated leverage: equity ratio dropped from ~40% to 15-16% post-Takeda acquisition, FX and inflation exposure across multi-country operations, Heavy concentration in Europe with minimal US presence, Post-acquisition integration risk (supply issues in 2022, site closures), ESG/CSRD compliance costs rising from FY2025, Poland production site is a significant Scope 1&2 emissions contributor

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report