Loading story…
FulcrumSec released another tranche of data allegedly stolen from Novo Nordisk, escalating a breach the company had previously disclosed. The newly exposed material reportedly includes the company's enterprise Hugging Face AI/ML environment, with about 30 models, 70 datasets, and roughly 0.5 TB of proprietary Cell Painting microscopy images.
The latest dump was described as separate from FulcrumSec's original leak, indicating continued publication of data after the initial incident. Reporting on the release said the disclosure expands the scope of the breach beyond earlier claims and raises concerns over the exposure of sensitive research and machine learning assets tied to Novo Nordisk's internal operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
FulcrumSec allegedly released additional data from Novo Nordisk that it said had not been included in its original post. The newly dumped material reportedly included Novo Nordisk's enterprise HuggingFace AI/ML ecosystem, including 30 models, 70 datasets, and about half a terabyte of proprietary Cell Painting microscopy images.
Novo Nordisk first disclosed the attack that was later linked to FulcrumSec's alleged data theft. This disclosure established the incident publicly before subsequent data leak developments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Novo Nordisk disclosed a cyberattack in which attackers accessed a limited number of internal IT systems and copied non-public data tied to some clinical trial participants and healthcare professionals. The stolen clinical trial information included pseudonymized patient identifiers rather than direct identifiers such as names, but it still covered sensitive fields including trial participation details, sex or gender, year of birth, biomarkers, health or immunogenicity data, and lifestyle factors such as smoking status, alcohol use, and BMI. The company said healthcare professional contact and registration details were also exposed, raising the risk of targeted phishing and impersonation attempts over email, phone, and WhatsApp. Novo Nordisk took affected internal systems offline as a precaution, brought in external cybersecurity experts to investigate, and said core business operations were not impacted, while the total number of affected individuals and the full scope of the breach remain under investigation.
Jul 12, 2026
**LexisNexis Legal & Professional** confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias **FulcrumSec** leaked roughly **2 GB** of allegedly stolen files on underground forums. LexisNexis stated the exposed information was **mostly legacy/deprecated data from prior to 2020** (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found **no evidence of impact to products or services**; the company reported the matter to law enforcement and engaged an external forensics firm. FulcrumSec claimed the intrusion began by exploiting the **React2Shell** vulnerability in an **unpatched React frontend application** to gain access to LexisNexis’ **AWS** environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., `.gov` email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.
Jun 29, 2026
Hugging Face disclosed that an **autonomous AI agent system** breached part of its production infrastructure after a malicious dataset exploited two code-execution paths in the company’s dataset-processing pipeline. The intrusion reportedly achieved code execution on a processing worker, escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters at machine speed. Hugging Face said the attacker accessed a limited set of internal datasets and several service credentials, while reporting **no evidence** of tampering with public models, datasets, Spaces, or its software supply chain. The company said it closed the exploited execution paths, rebuilt compromised nodes, rotated secrets, tightened cluster controls, and notified law enforcement while continuing to review possible partner and customer data exposure. In its incident write-up, Hugging Face said AI-assisted detection and LLM-driven forensics helped reconstruct more than **17,000 attacker events**, and outside reporting linked the breach to a broader pattern of AI-driven intrusions in which autonomous agents can rapidly adapt, recover from errors, escalate privileges, and compress defender response times, raising concern over hybrid human-plus-AI attack operations.
Aug 11, 2026