Novo Nordisk Data Breach Exploits Hardcoded GitHub Tokens

• •FulcrumSec exploited hardcoded credentials to breach Novo Nordisk.
• •Over 1 terabyte of sensitive data was stolen, including drug data and customer records.
• •The breach was facilitated by a GitHub PAT and an Azure DevOps token.

Novo Nordisk suffered a data breach linked to the cyber extortion group FulcrumSec, which exploited hardcoded credentials found in client-side JavaScript across two subdomains. The attackers accessed over 1 terabyte of sensitive data, including experimental drug data and customer records, after gaining entry in June 2026. FulcrumSec utilized a GitHub Personal Access Token (PAT) and an Azure DevOps token, allowing them to navigate through Novo's cloud environments, including Amazon Web Services. The breach highlights the dangers of hardcoded credentials, as the attackers were able to exploit these vulnerabilities for two months before data was leaked. The group has previously targeted other organizations, showcasing a pattern of opportunistic cybercrime. Current reports indicate that the breach is ongoing, with the potential for further data exposure if not addressed. The incident emphasizes the need for better credential management and security practices in cloud environments.