TLDR Tech / InfoSec
Novo Nordisk Breach: How a Leaked GitHub Token Exposed the Exact Ozempic Formula
A group calling itself FulcrumSec claims initial access in March via a single GitHub personal access token that allowed cloning of internal repositories, then roughly two months of undetected dwell time before exfiltrating 700,000+ files (~1.3 TB), with Novo Nordisk confirming a limited intrusion on June 11 and reportedly refusing a $25 million extortion demand that triggered a 264 GB leak allegedly including source code, clinical trial records for ~11,500 patients, and the Ozempic formula. The detectable signal here was a token quietly cloning hundreds of repositories over weeks, plus large outbound data flows, neither of which was alerted on, which maps to OWASP A07 credential failures rather than any novel technique. Defenders should treat PATs, deploy keys, and CI tokens as bearer credentials with short expirations, narrow scopes, IP allowlists, and SSO-backed accounts, build alerting for abnormal bulk-clone and outbound-transfer patterns rather than just logins, and run secret scanning against their own repos before a stolen token turns into a master key.
Read the full story