A single API token, left sitting in plain sight inside a public website's JavaScript, opened the door to Novo Nordisk's cloud infrastructure and, eventually, to 1.3 terabytes of stolen data. The group behind it, FulcrumSec, didn't need a zero-day exploit. It needed a browser's "view source" button.

FulcrumSec calls the technique its "Hardcoded Horrorshow": scan public-facing websites for API tokens and credentials that developers accidentally leave inside client-side JavaScript bundles, the code every visitor's browser downloads and anyone can read. Novo Nordisk, the Danish maker of Ozempic, became the group's highest-profile victim in March 2026, and the fallout is still spreading six months later.

RelatedLiteLLM breach: 40 minutes, 2,488 companies exposed

  • FulcrumSec found two hardcoded personal access tokens inside Novo Nordisk's public JavaScript in March 2026: an Azure DevOps PAT on one site, a GitHub PAT on another.
  • The GitHub PAT alone opened more than 1,000 private Novo Nordisk repositories, and several of those repos held still more hardcoded credentials for production systems.
  • About two months of quiet lateral movement through Novo Nordisk's AWS and Hugging Face environments ended with roughly 1.3TB exfiltrated, including source code, Ozempic pipeline data, and about 11,500 clinical trial records.
  • Novo Nordisk refused a $25 million ransom demand, and FulcrumSec has begun publishing the stolen data on its own leak site.
How one hardcoded token became a 1.3 terabyte breach Flow diagram: a public website's JavaScript bundle contains a hardcoded token, which is found and used to gain GitHub and Azure DevOps access to over 1,000 private repositories, which themselves contain more hardcoded secrets, leading to two months of lateral movement across AWS and Hugging Face, ending in 1.3 terabytes exfiltrated. PUBLIC SITE Client-side JS bundle ships to every browser HARDCODED PAT Azure DevOps + GitHub PATs found in the bundle REPO ACCESS GitHub PAT unlocks 1,000+ private repositories SECRET SPRAWL Repos hold more hardcoded production credentials LATERAL MOVEMENT ~2 months across AWS and Hugging Face EXFILTRATED 1.3TB: source code, drug data, 11,500 trial records genztech.blog
Fig 1 One overlooked token in client-side code was the entire chain: everything from the 1,000-repo GitHub sprawl to the 1.3TB exfiltration traces back to it.

What did FulcrumSec actually find in Novo Nordisk's code?

Two separate secrets, on two separate public-facing sites, both left inside JavaScript that ships straight to a visitor's browser. One was a personal access token scoped to an Azure DevOps environment. The other was a GitHub PAT. Neither was hidden behind anything worth calling protection: minified JavaScript is still fully readable text, and pulling credentials out of it is a matter of searching for strings that look like tokens, not breaking any encryption.

That second detail, the GitHub PAT, is the one that turned a routine credential leak into a catastrophe. It didn't just unlock one repository. It unlocked more than 1,000 private ones.

How does one leaked token turn into 1.3 terabytes?

Through sprawl. A single GitHub PAT with broad scope can list and clone every private repository its owning account can see, and at a company the size of Novo Nordisk, that's a lot of repositories: internal tools, service code, infrastructure-as-code, and, critically, more secrets. Security teams call this pattern secret sprawl for a reason. Credentials get copied into config files, checked into git history, embedded in test fixtures, and forgotten, and every repo an attacker reaches becomes a fresh place to go looking for the next one.

That's exactly what happened here. Inside the trove of newly accessible repositories, FulcrumSec found more hardcoded credentials, this time for production systems. From there the group spent roughly two months moving laterally through Novo Nordisk's cloud environments, including AWS and Hugging Face instances, quietly enough to avoid tripping whatever alarms were watching. By the time it started pulling data out, it had a long list of places to pull from: 1.3 terabytes total, covering source code, drug-pipeline data tied to Ozempic, and about 11,500 clinical trial records.

Why does a JavaScript bundle even contain a PAT in the first place?

Usually by accident, and usually because a build process or a script meant for a developer's machine or a CI pipeline ends up bundled into what ships to the browser. A token pulled from an environment variable during a local build, a debug flag left in production code, a config file that should have stayed server-side. None of it requires malice. It just requires nobody catching it before deploy, and secret-scanning tools that check code repositories don't automatically check the compiled output that actually reaches the public internet.

Who else is exposed to the same mistake?

Anyone shipping a website with client-side JavaScript that talks to an API, which is close to every company with a modern web presence. Pharma isn't the target here. Hardcoded credentials in browser-delivered code are a generic, industry-agnostic weakness, and FulcrumSec's entire business model is built on assuming plenty of large organizations still have this exact problem sitting in production right now, unnoticed. Novo Nordisk is the highest-profile name attached to the "Hardcoded Horrorshow" campaign so far, not because pharma companies are uniquely careless, but because it's the target that made headlines.

RelatedBrevo Breach Exposes 347K Trezor Users to Phishing Scam

What happened after Novo Nordisk said no to the ransom?

FulcrumSec demanded $25 million. Novo Nordisk refused, and the group followed through on the threat it had been building toward for two months of quiet access: it started publishing the stolen data on its own leak site. That's the standard extortion playbook for this category of cybercrime group, pressure a victim with a deadline, then use partial or full public disclosure as the consequence for refusal. Once the data is out, no ransom payment puts it back.

Is FulcrumSec still doing this to other companies?

As of the week of September 11, 2026, security-news roundups were still listing Novo Nordisk among FulcrumSec's ongoing "Hardcoded Horrorshow" victims, which points to an active, continuing campaign rather than a one-off hit. The technique doesn't require custom tooling or novel research. It requires patience and a willingness to scan a lot of public websites for a mistake that keeps recurring. Nothing about that method depends on the target being a pharmaceutical company, so there's no particular reason to expect Novo Nordisk was the group's only target, or its last.

  1. Mar 2026FulcrumSec finds a hardcoded Azure DevOps PAT and a GitHub PAT inside Novo Nordisk's public JavaScript; the GitHub PAT unlocks over 1,000 private repositories, several holding more hardcoded production credentials.
  2. Mar-May 2026Roughly two months of quiet lateral movement through Novo Nordisk's cloud environments, including AWS and Hugging Face instances.
  3. ~May 2026FulcrumSec exfiltrates about 1.3TB: source code, Ozempic drug-pipeline data, and roughly 11,500 clinical trial records.
  4. After exfiltrationFulcrumSec demands a $25 million ransom; Novo Nordisk refuses to pay.
  5. Following the refusalFulcrumSec begins publishing the stolen data on its own leak site.
  6. Week of Sep 11, 2026Roundups still list Novo Nordisk among FulcrumSec's active "Hardcoded Horrorshow" victims, pointing to an ongoing campaign against other public-facing targets.

Our take

What makes this breach unsettling isn't sophistication, it's the absence of it. FulcrumSec didn't write custom malware, didn't chain together a set of exotic vulnerabilities, and didn't need an insider. It read a JavaScript file that a browser downloads by default, found a token nobody was supposed to leave there, and rode that single mistake into 1,000-plus repositories, two cloud providers, and 1.3 terabytes of a pharmaceutical giant's most sensitive data. That's the scary part. A well-funded, security-conscious company like Novo Nordisk can still ship a client-side secret, and the cost of that one slip was measured in terabytes, not megabytes, because of how naturally it compounded once discovered.

What to watch
  • Audit your own JS bundles. Search production frontend code, not just source repos, for anything that looks like a token, key, or connection string.
  • Rotate PATs on a schedule. A long-lived personal access token that never expires is a standing liability the moment it leaks, whenever that happens to be.
  • Move to short-lived, scoped tokens. Fine-grained, time-limited credentials narrow what an attacker gets even if one does leak.
  • Turn on secret scanning everywhere it reaches, including build output. A scanner that only checks source code misses exactly the kind of leak that hit Novo Nordisk.
Primary sources

Original analysis by GenZTech, based on public breach disclosures and security-research coverage of the FulcrumSec "Hardcoded Horrorshow" campaign.