One stolen token, 700,000 files: what the Novo Nordisk breach says about the data layer

In June 2026, an extortion group calling itself FulcrumSec claimed it had stolen roughly 1.3 terabytes of data from Novo Nordisk, the Danish pharmaceutical company behind Ozempic and Wegovy, and demanded $25 million. According to public reporting from outlets including SecurityWeek, Dark Reading, Cybernews, and BankInfoSecurity, the group offered a list of more than 700,000 files as proof of possession. Novo Nordisk confirmed that attackers gained unauthorized access to a limited number of internal systems and copied non-public data, and said that patient-related information involved was pseudonymized and could not be directly linked to individuals without additional data the attackers did not hold.

The reported path in is the part every security team should sit with. Public reporting indicates the attackers found a GitHub access token around March 2026, used it to clone repositories and harvest additional credentials, and then remained inside the company’s cloud and code infrastructure for more than two months before surfacing a ransom demand. One credential became a key to a great deal more than one repository.

The alleged inventory reads like a map of a pharmaceutical company’s most sensitive unstructured data: source code, proprietary data on marketed and undisclosed drug programs, clinical-trial and research records, private AI models, and documents tied to manufacturing and production technology. This is not a single database. It is the accumulated file estate of a large enterprise: the material that lives on network-attached storage, in repositories, and across shares, reachable over SMB, NFS, S3, and Web Drive.

When one leaked token can traverse that much, the failure is not only that the token leaked. It is that nothing constrained how far a single credential could reach, and nothing recognized that the credential was reaching. Attribute-based access control enforces least privilege at the file, per operation, so a compromised account is boxed into what it legitimately needs rather than free to roam a decade of programs and records.

If the reported timeline holds, the attackers spent over two months reading and cloning at scale. That is not a lightning smash-and-grab; it is a sustained bulk-read campaign against production data. A session that steadily reads hundreds of thousands of files it has no prior relationship with is behaviorally unmistakable. It is also invisible, unless something at the storage layer analyzes every operation instead of simply serving it.

This is what Active Defense is built to do: profile normal access per user, host, and dataset, recognize when a pattern of reads departs from it, and terminate the session before the staging completes. Incidents shaped like this one are the reason the approach exists.

Least privilege has to be real, and it has to be enforced where the files actually live rather than merely asserted at the identity provider. A token’s blast radius is a design constraint. Most organizations discover theirs during incident response.

Detection has to reach the data itself. Endpoint and network tools sit upstream of the read that actually matters, and a NAS that is not watching behavior cannot tell a credentialed bulk read from a Tuesday.

Once data has already left, an immutable, per-operation audit trail is the difference between a precise disclosure and a worst-case assumption. Novo Nordisk declined to pay, and the group began leaking. Restoring from backup does not pull a published file back off the internet. The only moment this class of attack can be stopped is while it is happening, and by then the token is valid, the session is authorized, and the reads have already started.