Novo Nordisk, the Danish pharmaceutical giant behind Ozempic and Wegovy, disclosed a cybersecurity breach on June 11 after detecting unauthorized access to what it claimed were a "limited number of its internal IT systems."
The stolen information includes source code, proprietary information on marketed and unreleased drugs, clinical trial and research data, internal AI models, records related to Novo Nordisk's manufacturing operations and production technology, healthcare professional records, and information on approximately 11,500 pseudonymized clinical trial participants.
Hi, and thanks for taking the time to speak with Inside Darknet. For everyone who might not know the name yet - who is FulcrumSec, and what do you do?
We are a cloud-oriented data extortion group (no ransomware ; we don't encrypt or wipe data).
We do our best to operate as ethically as possible without undermining the deterrence factor of leaking uncooperative companies' data. This means minimising harm to individuals while maximising reputational harm to those companies who do not work with us.
You can see this in our youX data leak (https://fulcrumsec.vg/youx/), where we withheld hundreds of thousands of users' financial data because youX had already been publicly broken, as well as our redaction of names in any breach involving PHI or minors. We were all horrified by the Vastaamo breach and never want to cause this sort of harm.
Vastaamo was a Finnish psychotherapy provider whose patient records were stolen in 2020, and then used to individually extort thousands of therapy patients. That case is widely considered one of the most harmful data breaches in European history.
Do you believe pure data extortion is becoming the more viable model, especially as more infrastructure moves to cloud environments where deploying a traditional locker is impractical?
We believe so, yes. You can already see this shift. For us, a very small group, it would be difficult to scale traditional on-prem/corporate network attacks like we have with pure cloud exfil. End to end, we can break in and walk out the door with terabytes of data within a couple of hours, easily.
The bottleneck is actually analysing the data we've taken and making sense of it. We spend significantly more time doing that and doing research to understand the implications if the data were to leak than we do actually hacking or exfiltrating it.
Recently your group went very viral after breaching Novo Nordisk. I believe you got initial access through an Azure container registry token and a GitHub personal access token. Can you share how you found those and how they can be used?
Yes, but it was actually an Azure DevOps token not ACR (we misreported this ourselves initially), in addition to the GitHub token. These allowed access to thousands of private source code repos, from which we extracted a wealth of other credentials that we used to pivot through their systems.
Where do groups like yours find these access tokens? Through info stealer logs, or other compromised assets?
We have multiple pipelines for this. We do not use stealer logs ; all of the credentials we use we find or take ourselves.
As many people preach that Cloud will solve everything: You never had access to Novo Nordisk's Active Directory or on-prem infrastructure? This was entirely possible through cloud-to-cloud lateral movement?
No, we never got into their corporate network. When a company's most sensitive data is stored in the cloud, we simply don't need to.
From there, you moved laterally through the company network for over two months. Novo Nordisk only disclosed the breach on June 11. Did they detect you during those two months?
They detected us service by service, but quite slowly.
The GitHub token was revoked first, after weeks of usage and full exfiltration, then other credentials. Other services, like Okta and the keys for their massive enterprise HuggingFace account, were never detected (in spite of pulling over a terabyte of proprietary AI/ML model weights and other data from the HF account). We handed these keys over to Novo in our initial outreach email as a peace offering. A lot of the most sensitive data was exfiltrated from other environments after they already knew GitHub and Azure had been compromised.
You demanded $25 million from the company. What is happening now?
Novo stated they were not going to pay. Since they went dark on us the day of their public disclosure, we determined they only engaged with us to buy time while they prepared to notify. They would have ghosted us, but we offered to withhold the PII on employees, physicians, and clinical trial patients if they had the decency to tell us upfront. They did, and we are thus withholding the data.
What would have happened if they paid the $25 million? And would you have been open to negotiations?
We would have thanked them and deleted the data, and the world would only know of the PII exposure they disclosed, since we only claim breaches publicly when a deal is clearly not going to be reached.
Of course we are open to negotiations, to a reasonable extent. We believed Novo would settle at around $18-20 million after some back and forth.
There's a lot of companies spending a ton of money on cybersecurity. What do you think about Novo Nordisk's security posture?
It was pretty terrible. For comparison, small companies with maybe .01% of their security budget often detect us within days. Massive corporations have a massive problem watching their cloud services. It is a pattern we see again and again. They seem completely blind to terabytes of data walking out the door.
Last month we conducted a 290+ TB exfil of a publicly traded American company's Google Cloud Storage buckets and BigQuery. This sounds like an exaggeration, we realise, but it is not. Nearly 300 terabytes. We can't name them because they came to an arrangement with us and we deleted the data (thankfully, it was costing a small fortune to store it), but they did not notice us the entire time. How is that possible? If we hadn't contacted them first, they probably wouldn't have figured it out until they got their next GCP bill.
Do companies like this get information how you breached them? How can companies be sure the information is not on backups for later use?
Yes, one of the deliverables we provide to paying companies is a detailed security report on how we gained initial access and moved laterally, and how they could have stopped us at every point along the way.
The biggest challenge of all of this might be overcoming the resistance companies have toward believing the word of cybercriminals and convincing them that we will abide by what we promise (deletion, silence). We have a whole pitch dedicated to this -- it's basically sales.
It boils down to 1) We are honourable thieves and, since that's an understandably hard sell, 2) We make vast sums of money doing this, and it would be absolutely insane to endanger that by not deleting the data or by running our mouths when we promise silence. For what? For sales of a few thousand, or a few hundred thousand? For clout? Not worth it at all -- truly and completely.
We believe our transparency throughout the process helps companies believe this, but this undeniable incentive structure is probably the primary reason: for a rational economic actor who makes the amount of money that we do, it would be extraordinarily stupid not to keep our word. If we're breached or there's a leak (e.g. with Conti), and we are shown to have not kept our word, we are done ; it would be over, all the work of the last ~8 months down the drain.
So we keep our word. It's central to our identity, and also the smart thing to do.
You publicly stated you would not release data on employees, physicians, or the 11,500 pseudonymized clinical trial patients. Why? Is this for ethical reasons?
In this case, no (see above). In cases of more serious exposure, we do withhold or redact especially sensitive data.
Is there anything nobody outside your circle or the company knows yet; something you're willing to share?
One minor development we haven't spoken of publicly: Novo immediately got our clearnet domain killed within hours of the post going live (we went back online at fulcrumsec.vg just as quickly).
In response, we told them that they were not going to be able to suppress the leak -- it's already up on DDoSecrets, the torrent is humming, and our .onion download will always be there -- and warned them that if they kept up the adversarial behaviour, we would no longer feel bound by our agreement not to release the PII. The .vg domain is still up, so make of that what you will.
Did Novo go after the domain through a registrar abuse report, or did they actually hit it with a DDoS?
They got Tucows to kill it via an abuse report, or, given the speed, an internal contact via a phonecall from someone powerful. Other companies doubtless try this but Novo had the juice to get it done immediately.
And one final question: If you could give one final message to the public - what would you say?
To those in IT/infosec: watch your companies' cloud environments, patch, and secure your secrets. Our primary methods of initial access are not fancy or sophisticated, and this sort of basic security hygiene will largely protect you from us.