FulcrumSec

FulcrumSec is a financially motivated cybercriminal group focused on data theft and extortion. Its targets include technology providers, cloud database services, transportation operators, and market-research businesses. It demands payment in exchange for withholding stolen information and publishes victim data through leak-site disclosures when payment is refused. Its established operating model is data-theft extortion; the available evidence does not establish deployment of file-encrypting ransomware. FulcrumSec exploits exposed credentials and compromised accounts to access cloud services, private source-code repositories, and customer-information systems. In the Manchester Airports Group incident, exposed server-side Iterable API keys embedded in public JavaScript enabled access to customer records associated with airport Wi-Fi registrations and ancillary booking services. The breach exposed information concerning approximately 8.8 million people without affecting core airport operations. In the PingCAP incident attributed to the group, investigators traced access to a compromised GitHub account and exposed credentials that enabled access to cloud infrastructure and internal collaboration systems. Confirmed stolen information included source code, customer-related records, and business data. The group also uses large language models to analyze stolen datasets and identify individuals appearing across multiple databases. This post-exfiltration processing supports targeted extortion by identifying sensitive information and presenting structured evidence of exposure. Public disclosures are central to its pressure strategy, extending the consequences of an intrusion beyond the initial theft.