[fulcrumsec]

September 3, 2026

• Fulcrumsec published its Manchester Airports Group haul — just over 500GB, covering 8.7 million people and far broader than the guest Wi-Fi data initially implied, with a list of other organisations the group is trying to extort now posted alongside it (BBC, @GossiTheDog) (earlier coverage). (discussion) · Breaches & Leaks

in Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion

September 2, 2026

• Manchester Airports Group's 8.7-million-record breach traces to API keys committed into frontend JavaScript. Kevin Beaumont verified the exposure from web archives and reports FulcrumSec has now released over 500 GB — far broader than the guest Wi-Fi data initially implied (Kevin Beaumont). The operationally interesting part: he's watching FulcrumSec mass-harvest .js files and run them through automated credential scanners at scale — plain automation, not GenAI (Beaumont on FulcrumSec's method) (earlier coverage) (discussion). · Breaches & Data Exposure

in OpenAI Says Astra Crossed the Line: Autonomous Zero-Day Discovery at "Critical" Cyber Risk

August 31, 2026

• FulcrumSec claims 86 GB from Manchester Airports Group, and BleepingComputer validated one traveller record — with samples showing customer, booking and travel detail beyond what MAG initially disclosed (BleepingComputer) (earlier coverage). · Threat Activity

in Fully Patched, Still Domain Admin

June 20, 2026

FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

FortiBleed has compromised ~86,644 internet-facing FortiGate devices in a credential-harvesting campaign, while a leaked GitHub token gave FulcrumSec access to Novo Nordisk, exfiltrating 1.3TB including unreleased drug formulas and internal AI models. Mastra npm packages were trojanized by Sapphire Sleet (North Korea–nexus), and multiple AI infrastructure flaws emerged: SearchLeak (CVE-2026-42824) in Microsoft 365 Copilot, Pickle in the Middle in Google Vertex AI, and vulnerabilities in LiteLLM. Ransomware gangs including Qilin, Gentlemen, and DragonForce continue dominating the threat landscape with EDR-killing tradecraft and cloud-based C2 abuse.

June 18, 2026

• Novo Nordisk (Danish pharma giant) confirmed a breach in which FulcrumSec claims 1.3TB exfiltrated and a $25M ransom — notably including the company's internal AI assets: a 16GB trained model checkpoint, proprietary training data, full pipeline source (modeling_novopert.py), 113 training-run logs, and HPC/Slurm/SSH infrastructure maps. A concrete example of AI model/IP theft as an extortion payload (SecurityWeek, vx-underground). · Data Breaches (Nordic emphasis)

in ShinyHunters Burns a PeopleSoft Zero-Day Through Higher Ed as Copilot "SearchLeak" Shows AI Is the New Exfil Channel