Novo Nordisk Breach Exposes Over 1 TB of Sensitive Data via Stolen GitHub Access Tokens
What Happened — Attackers from the FulcrumSec extortion group leveraged hard‑coded GitHub personal access tokens (PATs) and an Azure DevOps token that were unintentionally embedded in client‑side JavaScript on two public Novo Nordisk sub‑domains. The stolen tokens granted unfettered access to more than a thousand private repositories, which contained additional cloud‑service credentials. Over a two‑month period the actors moved laterally through AWS and Hugging Face environments and exfiltrated roughly 1 TB of experimental drug data, patient records, and other proprietary information.
Why It Matters for Trust & Control Assurance
- This incident illustrates a classic failure of credential hygiene—a control objective that continuous‑control‑assurance programs must monitor, evidence, and remediate.
- Demonstrable secret‑management policies and automated scanning of code repositories are essential evidence for audit readiness under the Identify/Protect functions of NIST CSF 2.0.
- A robust access‑control assurance capability (e.g., Verisq’s Access Controls module) provides the continuous monitoring and proof points needed to show that privileged tokens are inventoried, rotated, and protected.
Who Is Affected – Pharmaceutical & life‑science companies, cloud‑native development teams, and any organization exposing secrets in client‑side code.
Recommended Actions
- Inventory all GitHub and Azure DevOps personal access tokens; enforce least‑privilege scopes and expiration policies.
- Deploy automated secret‑scanning tools in CI/CD pipelines to detect hard‑coded credentials before code reaches production.
- Update governance policies to require regular credential rotation and enforce “no secrets in client‑side code” rules.
- Capture evidence of these controls in a continuous‑monitoring platform to support audit readiness.
Technical Notes – Attack vector: stolen credentials (GitHub PAT, Azure DevOps token) embedded in JavaScript bundles; lateral movement via AWS and Hugging Face instances; data exfiltrated over two months. Source: DataBreachToday