On 11 June 2026, Novo Nordisk disclosed an IT security incident involving unauthorised access to a limited number of internal systems and the external copying of certain non-public and personal data. The cybercrime group FulcrumSec claims responsibility. According to the group, credentials exposed in client-side JavaScript on two unrelated subdomains provided initial access. Novo Nordisk has not confirmed that entry path.
For lean IT and security teams, the lesson is asset ownership. The gap can be as ordinary as an old campaign site left online after the campaign ended, a staging host still reachable after launch, or a development environment that never entered the central inventory. A frontend secret is public the moment it ships. Continuous discovery, clear ownership and inspection of every host close that gap.
What happened at Novo Nordisk
Confirmed by Novo Nordisk: Unauthorised access and the external copying of certain non-public and personal data.
FulcrumSec's account: Credentials exposed on two subdomains provided initial access. Novo Nordisk has not confirmed that entry path or the group's claimed breach scope.
| Date | Event | Status |
|---|---|---|
| March 2026 | FulcrumSec claims it found an Azure Container Registry credential and a GitHub personal access token in client-side JavaScript on two subdomains | Attacker claim |
| 11 June 2026 | Novo Nordisk publicly discloses unauthorised access to a limited number of internal systems and external copying of certain non-public and personal data | Novo-confirmed |
| 16 June 2026 | SecurityWeek reports FulcrumSec's claim of responsibility, March access and ransom demand | Reported attacker claim |
| 18 June 2026 | Novo describes the affected data and response; HIPAA Journal reports FulcrumSec's account of credentials exposed in frontend JavaScript | Novo-confirmed and reported attacker claim |
| 5 August 2026 | MedWatch reports US class-action lawsuits alleging inadequate protection of personal and health data | Reported legal allegations |
| August 2026 | BankInfoSecurity reports a later data release by FulcrumSec with revised attacker-supplied scope figures | Reported attacker claim |
In August, FulcrumSec released more data it claims came from Novo Nordisk, bringing the incident disclosed in June back into view. The group claims its first release exposed information about Novo's compounds, manufacturing recipes and source code. It claims the second exposed machines and datasets used to create new compounds. BankInfoSecurity reported the release, while MedWatch reported US class actions filed after the incident. Novo Nordisk has not confirmed those contents or FulcrumSec's revised scope figures. FulcrumSec's claimed entry path leads to a concrete control: discover every live subdomain, assign an owner and inspect the JavaScript it serves.
How does a credential end up in client-side JavaScript?
Client-side JavaScript must reach the browser before it can run. Anyone who can load the page can inspect the downloaded code. A credential hard-coded into the bundle is exposed to every browser that downloads it.
The exposed GitHub token does not mean the breach started with a repository leak. BankInfoSecurity quoted FulcrumSec claiming it gained initial access through "secrets left in client-side JavaScript on two separate unrelated Novo Nordisk subdomains." The group claims it accessed repositories afterwards and used credentials found there to move into additional systems.
How subdomains fall out of routine review
FulcrumSec claims the subdomains belonged to two different teams and applications. Its account does not establish how Novo Nordisk assigned or reviewed those hosts. For teams reviewing their own estate, every live host needs a named owner, a current purpose and routine review.
DNS and hosting can remain active after a campaign ends, an application launches or an integration changes owners. Keep the host under named ownership and routine review, or decommission it.
Find the assets missing from inventory
Query certificate transparency logs, passive DNS and subdomain enumeration data, then compare the results with the internal inventory. Repeat the comparison to flag new hosts for ownership review. Certificate transparency covers publicly logged TLS certificates; passive DNS and enumeration add further host candidates.
What happens after you discover the host?
Discovery tells you the host exists. Assign an owner and inspect it, or decommission it.
We use subdomain enumeration and attack surface monitoring to combine certificate transparency logs, DNS enumeration and brute-force discovery into a daily inventory of discovered hosts. After you bring a host under management, the web vulnerability scanner crawls its pages and referenced JavaScript for information disclosure and common web weaknesses. Optional Nuclei templates add further checks. Confirmed findings enter the remediation lifecycle: rotate the exposed credential, then rescan to confirm the exposure is gone.
Scanners can miss credentials in JavaScript bundles. Repeat discovery and inspection, then rescan after remediation.
What external scanning can and cannot tell you
An outside-in vulnerability scan identifies open services, misconfigurations, information disclosure and unexpected public hosts. It does not show what happened after access. Use identity monitoring, endpoint detection, log analysis and incident investigation to determine whether an attacker used the exposure. Remediation followed by a successful rescan confirms the exposure is gone.
A weekly attack-surface control for lean teams
For a lean team, the weekly control is a short ownership review:
- List what is exposed. Generate a current list of live subdomains and certificates.
- Flag the unknowns. Compare every new or unrecognised asset with the internal inventory.
- Assign an owner. Every host maps to a team that maintains it, or it comes down.
- Inspect the web surface. Crawl each owned host for exposure and misconfiguration.
- Act on what you find. Investigate any exposed credential, revoke or rotate it, remove it from client-side code, then rescan.
Find the assets outside your inventory
A host missing from inventory can remain reachable while its DNS and hosting stay active. Daily discovery flags it for ownership, inspection or removal.
Read-only access · Working scan data deleted after each scan · EU-hosted
Frequently asked questions
Can anyone read a secret in client-side JavaScript?
Anyone who can load the page can inspect its downloaded JavaScript. A credential embedded in that code is therefore exposed without any server compromise.
What is external attack surface management?
External attack surface management continuously discovers and monitors an organisation's internet-facing assets. Teams assign each asset to an owner or decommission it.
Does a vulnerability scan detect a breach in progress?
No. A vulnerability scan identifies reachable exposures such as open services, misconfigurations and information disclosure. Use identity monitoring, endpoint detection, log analysis and incident investigation to determine whether an attacker used them.
How do you find forgotten subdomains?
Start with certificate transparency, passive DNS and subdomain enumeration. Compare the discovered hosts with the internal inventory, then assign each unknown asset to an owner or decommission it.
What should you do if a credential is exposed in client-side JavaScript?
Revoke or rotate the credential immediately, then remove it from the client-side code so a redeploy does not expose it again. Review access logs for use of the leaked credential, check the systems it could reach, and rescan the host to confirm the exposure is gone.
