Data theft is overtaking encryption
23rd June 2026Cyber threats are continuing to evolve. Where ransomware attacks once centred on encrypting systems to force payment, attackers are now increasingly prioritising the theft of sensitive data. This shift materially raises the risk profile for large organisations, particularly those holding valuable intellectual property, clinical datasets, or AI assets.
A recent high-profile example is the cyber incident involving pharmaceutical company Novo Nordisk. In this case, at least one cyber extortion group operating under the name FulcrumSec claims to have maintained access to the company’s environment for over two months, ultimately exfiltrating approximately 1.3TB of highly sensitive data. Public reporting and researcher commentary also suggest that a second group attempted to extort the organisation concurrently, with reported ransom demands of $25 million and $50 million.
Novo Nordisk has confirmed that a cyber incident occurred and that non-public data, including pseudonymised clinical trial information, was accessed without authorisation. However, the company has not confirmed whether any ransom was paid.
What was stolen?
Available reporting and threat actor statements indicate that a substantial volume of highly sensitive information was compromised, including:
- Source code repositories: Approximately 4,700 - 4,800 repositories from Azure DevOps and GitHub, covering both application and infrastructure code, and containing more than 50 hard-coded production credentials.
- Drug research data: Proprietary molecules, chemical structures, and structure –activity relationships linked to current and future therapeutic developments.
- Manufacturing processes: Detailed information relating to major commercial drugs such as Semaglutide (used in Ozempic and Wegovy), including scaling methods, purification processes, yields, and supplier/CMO mappings. Data related to next-generation treatments such as Amycretin was also reportedly affected.
- AI assets: Approximately 30–33 trained AI models and 70–75 datasets, representing around 1–1.1TB of R&D data, including model checkpoints, training logs, and machine learning infrastructure components.
- Clinical and personal data: Pseudonymised clinical trial data covering around 11,500 patients (including demographic and biomarker data), alongside information relating to employees and physicians.
Collectively, this dataset represents not only significant financial value but also long-term competitive advantage, scientific insight, and market positioning.
Attack vector: How did the breach occur?
One of the most notable aspects of this incident is the relatively simple initial access point – highlighting a recurring issue despite growing focus on advanced and AI-driven threats.
Multiple sources indicate that the breach originated from a high-privilege GitHub personal access token (PAT) exposed within client-side JavaScript on an overlooked, internet-facing subdomain. The attack sequence is believed to have unfolded as follows:
- Attackers identified an outdated or unmanaged subdomain still accessible via the public internet.
- Within its client-side JavaScript, they located a GitHub PAT with elevated permissions.
- The token enabled them to clone private repositories from GitHub and Azure DevOps, which contained additional credentials such as API keys, database access details, and service account passwords.
- Over a period of approximately two to two-and-a-half months, these credentials were used to move laterally across cloud and internal environments (including GitHub and AWS), facilitating large-scale data exfiltration.
Reporting suggests that the exposed token was not immediately revoked, allowing the attackers sufficient time to expand access and harvest further credentials. Notably, there is no indication that advanced exploits or zero-day vulnerabilities were required. Instead, the breach appears to have resulted from gaps in credential hygiene, secret management, and asset visibility – common challenges in large, complex IT environments.
Threat actors and extortion dynamics
Public information indicates involvement from at least one primary threat group, with evidence of additional extortion activity:
- FulcrumSec: A cyber extortion group that emerged in late 2025 and has claimed responsibility for the breach. It states that it exfiltrated approximately 1.3TB of data across more than 700,000 files and issued a $25 million ransom demand, which reportedly was not paid.
- Secondary actor: Reporting suggests that a separate ransomware or extortion group attempted to monetise the same dataset, with a distinct demand of $50 million.
This scenario reflects an increasingly common pattern in which multiple threat actors attempt to exploit the same compromised data. Once exfiltrated, data is frequently shared, resold, or auctioned across criminal networks.
As a result:
- Organisations may face simultaneous or repeated extortion demands.
- Mitigating one threat actor does not eliminate risk from others.
- Stolen data can continue to be monetised through dark web sales, private transactions, or targeted disclosures.
This “multi-party extortion” model significantly reduces the effectiveness of traditional incident response strategies, such as refusing a single ransom demand.
Data theft as the primary pressure mechanism
The Novo Nordisk incident reflects a broader trend across industries: attackers increasingly prioritise data exfiltration, sometimes foregoing encryption entirely when stolen data alone provides sufficient leverage.
Key trends include:
- Routine exfiltration of high-value datasets (e.g. IP, HR, legal, M&A, clinical data, and source code).
- Increased targeting of R&D environments, development platforms, manufacturing processes, and AI assets.
- A shift in attacker leverage toward reputational damage, regulatory exposure, and IP loss rather than operational disruption.
Unlike encrypted systems, stolen intellectual property cannot simply be restored from backups. The consequences can include:
- Long-term erosion of competitive advantage.
- Exposure of proprietary research and development pipelines.
- Increased regulatory scrutiny, particularly where personal or health data is involved.
- Strategic insight gained by competitors or state-linked actors.
In this case, the theft of drug development data, AI models, and manufacturing processes could potentially reduce barriers to entry for competitors and erode Novo Nordisk’s long-term market advantage.
Key lessons for large enterprises
The breach highlights several persistent and critical risk areas:
- Asset visibility: Unmanaged or legacy internet-facing systems remain a common entry point.
- Credential and secret management: Hard-coded or long-lived tokens, particularly in client-side environments, create easily exploitable vulnerabilities.
- Development environments as critical assets: Platforms such as GitHub, Azure DevOps, and AI/ML pipelines must be treated as core elements of the attack surface, not ancillary tooling.
- Data protection focus: Preventing data exfiltration—through monitoring, egress controls, and zero-trust architectures—is now as important as ensuring system recoverability.
The Novo Nordisk incident illustrates a fundamental shift in cyber risk. The primary threat is no longer limited to system downtime or operational disruption, but increasingly centres on the exposure, theft, and monetisation of sensitive data.
For large organisations, the critical question is evolving—from “Can we restore operations?” to “Can we prevent our most sensitive data from being exfiltrated in the first place?”
https://www.securityweek.com/cybercrime-group-claims-novo-nordisk-hack/