Update (October 27, 2026): Added the PingCAP TiDB Cloud breach that FulcrumSec claimed after PingCAP confirmed unauthorized access, and the alleged Prospector Portal leak involving Guyana mining records.
FulcrumSec is a financially motivated data extortion group known for large-scale data theft from cloud environments, source code exposure and public dataset releases. It publishes detailed technical narratives about how it claims to have gained access, often blaming exposed credentials and misconfigured cloud storage.
Aliases: None publicly tracked by government or vendor sources
Type: Financially motivated data theft and extortion group
First observed: Late 2025, with claims dating back to October 2025
Primary operations: Cloud compromise, credential abuse, source code theft, data extortion and public dataset releases
Primary targets: Technology and SaaS providers, cloud-hosted data stores on AWS, Azure and Databricks, healthcare, education, transportation and professional services
Status as of October 27, 2026: Active, releasing data allegedly stolen from PingCAP
Unlike ransomware operations that encrypt systems, FulcrumSec centers its activity on data theft, public exposure and reputational pressure. It lists organizations alongside breach allegations, dataset descriptions, negotiation updates and branded campaign pages, and it frequently publishes source code, credentials and internal documents to support its claims. All claims are alleged unless confirmed by the affected organization.
Latest FulcrumSec activity
- October 26, 2026: PingCAP confirms a TiDB Cloud breach as FulcrumSec claims 10.6 TB of stolen data. PingCAP says an unauthorized party used stolen service account credentials between September 9 and October 7, 2026 to copy data and source code, and that live customer databases were not accessed. FulcrumSec claims 413 private repositories and more than 115,000 customer API keypairs, which PingCAP says were encrypted.
- September 1, 2026: FulcrumSec publishes data allegedly stolen from Manchester Airports Group. MAG confirmed on August 27 that customer data was obtained from car park, lounge, Fast Track and airport Wi-Fi records. The group claims the release covers about 8.7 million customer profiles and more than 1.16 billion activity records.
- August 12, 2026: FulcrumSec claims a second release of more than 1 TB of Novo Nordisk data, including what it describes as private AI models.
- June 16, 2026: FulcrumSec claims a 1.3 TB Novo Nordisk breach with source code, clinical data and research assets. Novo Nordisk confirmed an incident but has not verified the group’s claims.
- June 11, 2026: FulcrumSec alleges a 4.8 TB breach of Global Schools Group involving student, parent and employee data. The claim is unverified.
- May 9, 2026: FulcrumSec claims an Arup Group cloud infrastructure breach without a public proof package.
- May 8, 2026: FulcrumSec claims 287 GB of Stuf Storage data from AWS S3 buckets, including physical access information.
- April 21, 2026: FulcrumSec claims 2.2 TB from 52 AWS S3 buckets at Prospector Portal, an Analog Gold subsidiary, allegedly including Guyana Geology and Mines Commission records. The claim is unverified.
- April 20, 2026: Hatica allegedly breached, with the group publishing repositories, a production database and Slack bot tokens tied to about 4,700 workspaces.
- April 2, 2026: FulcrumSec dumps a MyComplianceOffice dataset after failed negotiations. MCO said the incident involved a legacy test or staging server and affected 12 customers.
Known and alleged victims
Organizations with BreachNews coverage or an official statement:
- PingCAP (incident confirmed, October 2026)
- Manchester Airports Group (incident confirmed, August 2026)
- Novo Nordisk (incident confirmed, scale unverified, June 2026)
- Global Schools Group (claimed, June 2026)
- Arup Group (claimed, May 2026)
- Stuf Storage (claimed, May 2026)
- Prospector Portal (Analog Gold) (claimed, April 2026)
- Hatica (claimed, April 2026)
- MyComplianceOffice (MCO) (limited incident confirmed, April 2026)
- LexisNexis Legal and Professional (breach confirmed by LexisNexis, March 2026)
Other organizations named by the group without public confirmation:
- YouX: named on leak site, unverified (September 2026)
- ReFocus: named on leak site, unverified (September 2026)
- Woundtech: named on leak site, unverified (September 2026)
- Lena Health: named on leak site, unverified (September 2026)
A leak-site listing is not confirmation of a compromise.
Campaign branding
FulcrumSec groups its disclosures into branded campaigns based on the security failure it claims to have found. This reinforces a recognizable identity and frames each victim around an alleged mistake.
The Hardcoded Horror Show
This campaign targets organizations that allegedly exposed credentials, API keys, authentication tokens, cloud keys and database connection strings in source code, application bundles, repositories or development environments. Its messaging accuses victims of leaking access through their own code rather than falling to sophisticated attacks.
Arup Group and Novo Nordisk, both covered above, appear in this campaign, along with entries marked “Coming Soon” and:
- Avnet: named on leak site, unverified (September 2026)
Index of Shame
This campaign targets organizations that allegedly exposed data through publicly accessible infrastructure, open directories, weak access controls, exposed databases and misconfigured cloud storage. Campaign material claims the exposed information may include customer records, payment and healthcare data, secrets, encryption keys and configuration files.
- FashionZA: named on leak site, unverified (September 2026)
- CrediElite: named on leak site, unverified (September 2026)
- Rotary International: named on leak site, unverified (September 2026)
- Raptor Supplies: named on leak site, unverified (September 2026)
- IMEVI: named on leak site, unverified (September 2026)
- Interzero: named on leak site, unverified (September 2026)
- SalesKido: named on leak site, unverified (September 2026)
- ParkEngage: named on leak site, unverified (September 2026)
- Nordstern Technologies / NCS: named on leak site, unverified (September 2026)
Slopocalypse Now
FulcrumSec has promoted Slopocalypse Now as a campaign aimed at AI companies, which it frames as custodians of large volumes of sensitive health, financial, legal and enterprise data. No victims had been publicly attributed to the campaign as of October 27, 2026.
Tactics and operational patterns
- Cloud environment compromise: Targeting AWS, Azure, Databricks, SaaS platforms and cloud storage.
- Credential abuse: Using exposed secrets, API keys, tokens and stolen service account credentials, as PingCAP described in its incident.
- Vulnerability exploitation: BreachNews reporting says the LexisNexis intrusion used an unpatched React2Shell flaw.
- Source code theft: Taking repositories, CI/CD configurations and internal tooling.
- Data-first extortion: Prioritizing exfiltration and publication over disruption.
- Public shaming: Publishing intrusion narratives and grouping victims into themed campaigns.
Focus on intellectual property and research assets
FulcrumSec increasingly targets source code, proprietary research, AI assets and development environments, not just customer records. Claims involving pharmaceutical research, database software and engineering firms suggest the group seeks leverage from information with commercial value beyond personal data.
Victim sectors
Claimed victims span technology and SaaS, healthcare, pharmaceuticals, education, transportation, engineering, storage, financial compliance and nonprofit organizations. The group favors organizations with large cloud footprints, extensive repositories and complex development environments.
Data publication and messaging
FulcrumSec often follows a claim with dataset releases, source code archives, credential collections and explanations of the alleged intrusion path. This reduces its reliance on long negotiations and builds credibility through repeated releases.
Its messaging frames the activity as exposing negligence, focusing on weak credential management, cloud misconfiguration and development mistakes. The framing does not change the criminal nature of the theft and extortion.
Threat assessment
As of October 27, 2026, FulcrumSec is one of the more active data extortion groups tracked by BreachNews. Confirmed incidents at PingCAP, Manchester Airports Group and LexisNexis show that some of its claims are tied to real intrusions, although the scale and contents it describes are often unverified.
Organizations should rotate secrets found in code, restrict service account credentials, audit cloud storage permissions and monitor for bulk data access, particularly in SaaS and development environments.
Attribution and verification
All claims attributed to FulcrumSec should be treated as unverified unless confirmed by the affected organization or independently validated. No government advisory or major vendor report has publicly profiled the group as of this update.
Sources and advisories
- PingCAP security incident report (October 19, 2026)
- Manchester Airports Group statement on cyber security incident (August 27, 2026)
- BreachNews guide: what is data extortion
Changelog
- October 27, 2026: Added PingCAP and Prospector Portal, corrected activity dates, linked or labeled every named victim, merged the campaign summary and added a fact box and sources.
- September 1, 2026: Added the Manchester Airports Group data release.
