FulcrumSec

September 12, 2026

• FulcrumSec says exposed GitHub tokens opened Novo Nordisk’s environment. DataBreachToday reports that the extortion group claims credentials embedded in client-side JavaScript provided initial access. It later released more than 1 TB of stolen data after the Danish company refused payment. The access narrative remains an operator claim rather than independently verified forensics. · Sep 12 · claimed · Cloud & Identity

Aug 28 – September 3, 2026 · 3 reports

• Fulcrumsec published its Manchester Airports Group haul — just over 500GB, covering 8.7 million people and far broader than the guest Wi-Fi data initially implied, with a list of other organisations the group is trying to extort now posted alongside it (BBC, @GossiTheDog) (earlier coverage). (discussion) · Sep 3 · observed · Breaches & Leaks
• Manchester Airports Group's 8.7-million-record breach traces to API keys committed into frontend JavaScript. Kevin Beaumont verified the exposure from web archives and reports FulcrumSec has now released over 500 GB — far broader than the guest Wi-Fi data initially implied (Kevin Beaumont). The operationally interesting part: he's watching FulcrumSec mass-harvest .js files and run them through automated credential scanners at scale — plain automation, not GenAI (Beaumont on FulcrumSec's method) (earlier coverage) (discussion). · Sep 2 · observed · Breaches & Data Exposure
• FulcrumSec claims 86 GB from Manchester Airports Group, and BleepingComputer validated one traveller record — with samples showing customer, booking and travel detail beyond what MAG initially disclosed (BleepingComputer) (earlier coverage). · Aug 31 · observed · Threat Activity

Jun 17 – June 21, 2026 · 3 reports

• Novo Nordisk is the subject of a breach claim by FulcrumSec, which says it stole 1.3 TB — including proprietary research and credentials — via a leaked GitHub token, demanding $25M and exposing the company's software development pipeline (SecurityWeek, Dark Reading). · Jun 21 · claimed · via stolen credentials · Data Breaches
• Novo Nordisk was breached after FulcrumSec found a GitHub token left in a repo for two months, ultimately exfiltrating 1.3TB including unreleased drug formulas and internal AI models; the company refused a $25M extortion demand and the data is now being sold (Dark Reading, SecurityWeek). A clean reminder that secrets management is an identity problem, not a tooling one. · Jun 19 · observed · Threat Activity & Intrusions
• Novo Nordisk (Danish pharma giant) confirmed a breach in which FulcrumSec claims 1.3TB exfiltrated and a $25M ransom — notably including the company's internal AI assets: a 16GB trained model checkpoint, proprietary training data, full pipeline source (modeling_novopert.py), 113 training-run logs, and HPC/Slurm/SSH infrastructure maps. A concrete example of AI model/IP theft as an extortion payload (SecurityWeek, vx-underground). · Jun 18 · claimed · Data Breaches (Nordic emphasis)