It started with an access token.
Not buried in some hardened secret store—no, this one lived on a developer's laptop, probably passed around like coffee in a team Slack channel. A GitHub token: cheap to make, easy to misuse, and devastating when leaked.
That one token gave attackers the first real foothold in Novo Nordisk's digital kingdom—yes, that Novo Nordisk, the Danish pharma giant behind Ozempic and Wegovy. And once inside? They didn't just crack the door open; they pulled the whole front wall down. According to threat actors calling themselves FulcrumSec, they staged into the environment and stayed there for over two months. Two months of mapping, probing, and pulling strings until they'd built a map so detailed, it could've been drawn by an internal auditor. When talks with Novo Nordisk collapsed, the data dump started.
The company called it a "limited number of systems." They said clinical trial data was pseudonymized. But the screenshots that slipped out before being taken down told a very different story: directory paths from internal CI/CD pipelines, test datasets tagged with coded patient IDs, AI training sets pulled straight out of the lab. In a world where proprietary algorithms and clinical metadata are worth more than cash, this wasn't just a breach—it was a heist.
How a Single Token Unlocked Everything
FulcrumSec didn't need zero-days or supply chain tricks. They just needed a token and the patience to watch where it led.
The entry vector? A GitHub app misconfigured with organization-wide read and write permissions. In most shops, that's a security team nightmare waiting to happen—but here, it was just another tool in the dev stack. Once inside, the token wasn't just a passcode; it was an identity. Suddenly, attackers weren't external—they were machine identities trusted by the build server, trusted by the artifact registry, trusted to deploy code into production.
From there, it was routine reconnaissance: pull commit history, follow references to internal tools in PR descriptions, and use those clues to find API endpoints hidden behind VPNs. One commit mentioned "internal AI training pipeline"—a phrase that unlocked an endpoint which, in turn, granted broader access. It's not glamorous hacking; it's just plain old detective work, but it works because most organizations treat developer tools as "safe." And that's the real story: this wasn't a code breach. It was a trust breach.
SecurityWeek reported the misconfigured app had no audit trail for token usage beyond basic logs. No one knew when the token was used, just that it existed. That's like giving a key to your house and trusting no one will ever break in—just because the key was issued by you.
What Stole—And Why It Hurts So Much
FulcrumSec claims 1.3 terabytes of data—but here's what actually matters:
Source code and internal tooling. The attackers stole public repos and internal scripts, but here's the kicker: they copied the deployment automation. That means they didn't just see your code; they saw how you ship it. In pharma, where regulatory compliance is baked into every line of code, that's not just embarrassing—it's dangerous.
Pseudonymized clinical data. Novo Nordisk says it was compliant with GDPR, and maybe it was—but "pseudonymized" isn't the same as "anonymous." Add a couple of internal notes, cross-reference with trial metadata, and you've got re-identification vectors. The European Data Protection Board already opened a preliminary inquiry; that's not just paperwork—it means fines in the tens of millions.
Proprietary AI models. This is where Novo Nordisk's real pain lies. The company invested heavily in machine learning for drug discovery, and FulcrumSec claims they pulled trained models—complete with hyperparameters, training data, and validation metrics. These aren't just files; they're years of research compressed into code. Sell one to a competitor, and you don't just lose competitive advantage—you lose billions in future revenue.
Project roadmaps and internal notes. Leaked slide decks, meeting minutes, and status updates gave attackers insight into what Novo Nordisk is building next. That slide deck titled "Project X – Phase III Readiness"? That's not just data; it's a strategic playbook for the next decade of drug development.
Employee and doctor contact lists. The actor claimed harvesting thousands of contacts—not just names, but email addresses, roles, and internal project assignments. That's not an embarrassment; it's a phishing arsenal. One well-crafted email could target Novo Nordisk's sales reps, who often have access to prescribing data.
Why Developer-First Security Failed
Novo Nordisk's audit had flagged some tokens with no expiry set—right before the breach. Yet, because those tokens were tied to active developers, they weren't flagged as high-risk.
That's the mistake most orgs make: treating developer identities like trusted insiders, not high-risk service accounts. GitHub tokens aren't just access keys—they're identities. And when you treat them like passwords, everything changes.
Here's what should've happened:
- Fine-grained permissions. GitHub supports scoped tokens down to the repository or even individual API endpoints. Most teams still use personal access tokens with org-wide rights because it's easier.
- Rotation cadence. Every token should expire, and the system should auto-renew—unless it's been unused for 30 days. Then, lock it and notify.
- Context-aware logging. Not just "token XYZ used," but "token XYZ accessed API ABC for purpose DEF at time T." If a token suddenly starts calling endpoints unrelated to its stated purpose, that's a flag.
A Scandinavian startup recently rolled out this stack—scoped tokens, scheduled rotation, contextual logging—and found three dormant tokens untouched for over a year. The actor who breached Novo Nordisk was active for two months. A few smarter checks could've caught them after the first access attempt.
The Bigger Picture: Developer Credentials as Attack Surface
The Novo Nordisk breach didn't happen in isolation. It's part of a broader pattern where developer tooling has become the primary attack surface for high-value targets. When a developer token compromise sparked a global pharma data-extortion crisis, the same playbook emerged: a single credential, poorly scoped, leading to cascading access across an organization's most sensitive systems.
And the supply chain dimension only deepens the risk. When npm packages under Red Hat's namespace were compromised in a supply-chain attack distributing Miasma malware, the takeaway was clear: if attackers can poison the tools developers rely on, every credential stored in a developer environment becomes a potential leak. The Novo Nordisk breach shows the other side of that coin—attackers don't need to compromise packages when they can simply steal the tokens developers already use.
FulcrumSec and the Hack-and-Leak Era
FulcrumSec isn't some lone hacker in a basement with a hoodie and a laptop. They're part of the new wave: hack-and-leak operators who don't just encrypt your data—they steal it, hold it over your head, and demand ransom.
Their playbook?
- Credential chain mapping. One token leads to five more; one token inside a service unlocks three internal APIs.
- Data triage. They don't steal everything; they grab the high-value stuff first—AI models, clinical data—and compress it before exfiltrating.
- Negotiation scripting. Leaked chat logs show FulcrumSec uses pre-drafted ransom notes and escalation paths—this is a business, not just crime.
Novo Nordisk's response—patch the app, rotate tokens, tighten controls—is table stakes. But here's the real test: will they bake continuous token auditing into their CI/CD pipeline? Will they start treating developer identities like service accounts—with revocable access and audit trails—or will this become another "incident closed" case file?
Because if they don't, every other tech-forward company is sitting on the same time bomb.
So—What's the Fix?
No fluff. Just real things that work.
-
Audit all tokens, yesterday. Use GitHub's API to list every PAT and app installation with org-wide access. Look for tokens without expiry, or those tied to inactive developers.
-
Force fine-grained permissions. Replace org-wide tokens with scoped ones that only let you touch what you need—no more, no less.
-
Rotate on a cadence. Every token expires, and the system renews automatically… unless it's been idle for 30 days. Lock it, notify the owner.
-
Add contextual logging. Track not just what token did something, but why. If it hits an endpoint outside its stated purpose, flag it.
-
Scan for leaks. Run regex rules across your issue tracker, PR descriptions, and commit history to catch 40-character hex strings that look like tokens. Tools like GitLeaks help—but don't rely on them alone.
This breach didn't happen because Novo Nordisk lacked security awareness. It happened because they assumed developer tools don't need the same oversight as service accounts.
The cost of fixing that assumption? Already paid—by Novo Nordisk, and by every company watching the news.
