Extortion Group FulcrumSec Turned a Hardcoded GitHub Token Into a 1.3TB Novo Nordisk Breach

How the Breach Happened

FulcrumSec’s method, which the group itself has reportedly dubbed the “Hardcoded Horrorshow,” relies on a class of vulnerability that security teams have flagged for years as both highly preventable and stubbornly persistent: credentials embedded directly in code that ships to end users. According to reporting on the incident, FulcrumSec found a personal access token for Novo Nordisk’s Azure DevOps environment sitting inside a JavaScript bundle on one of the company’s public-facing websites, alongside additional credentials found in client-side code on a second site.

Because that token was a valid GitHub personal access token, FulcrumSec was able to use it directly to access hundreds of private Novo Nordisk repositories — no phishing, no malware deployment, no exploitation of a software vulnerability in the traditional sense. The credential itself was the entire attack surface. Client-side JavaScript is, by definition, downloaded and executable by anyone who visits the page, which means any secret embedded in it is effectively public the moment the page goes live, regardless of whether anyone notices immediately.

Scale and Timeline

FulcrumSec began shaking down Novo Nordisk in June 2026 and, according to reporting on the group’s operations, spent roughly two months inside the company’s networks before extracting the data. The group ultimately pulled out approximately 1.3 terabytes of material, including drug research, clinical trial information, and internal AI models — the kind of intellectual property whose loss carries consequences well beyond a typical customer-data breach for a pharmaceutical company mid-pipeline on drug development.

When Novo Nordisk refused a $25 million extortion demand, FulcrumSec released more than a terabyte of the stolen data and began exploring a private sale of the remaining assets, according to the same reporting. The group’s business model — ransom sensitive data rather than encrypt systems — sidesteps the operational disruption that traditional ransomware causes and instead bets entirely on the sensitivity of what was stolen to force payment.

Why This Keeps Happening

Hardcoded credentials are one of the most consistently cited vulnerability classes in enterprise security research, precisely because the failure mode is so simple: a developer embeds a token, key, or password directly in source code — often for convenience during testing or because a build process wasn’t configured to inject secrets at runtime — and it either ships to production or ends up in a public repository. Unlike a zero-day exploit, this is not a sophisticated attack technique; it is closer to leaving a spare key under the doormat with a sign pointing at it.

The Novo Nordisk case is instructive because the exposure sat in public-facing client-side code — the most visible, most scannable location a secret can occupy. Automated secret-scanning tools exist specifically to catch this pattern before it reaches production, and the fact that a token with access to hundreds of private repositories survived undetected in a public JavaScript bundle points to a gap in that scanning discipline, not a failure of any exotic defense.

What Security Teams Should Take From This

The practical lessons here are unglamorous but concrete. First, secrets do not belong in client-side code under any circumstances — access tokens, API keys, and credentials must be issued and used server-side, with client-facing code calling authenticated backend endpoints instead. Second, automated secret-scanning should run continuously against both source repositories and deployed, built artifacts (the compiled JavaScript bundle that actually ships), since a scan of source code alone can miss secrets introduced during a build or bundling step. Third, access tokens should be scoped as narrowly as possible and rotated on a schedule, so that a single leaked credential does not grant broad, standing access to hundreds of repositories the way it evidently did here.

The FulcrumSec-Novo Nordisk case also underscores a point specific to sectors like pharmaceuticals: the value of what gets stolen when credentials are exposed is not generic. Drug pipeline data and clinical trial information carry competitive and regulatory weight that a typical customer database does not, which raises the stakes on getting basic credential hygiene right well beyond what a company’s baseline security budget might otherwise prioritize.

Frequently Asked Questions

Sources & Further Reading

• Novo Nordisk hack: FulcrumSec claims $25M extortion attempt — Yahoo Finance
• Novo Nordisk Data Breach Tied to Stolen GitHub Access Tokens — BankInfoSecurity