FulcrumSec

FulcrumSec is a financially motivated data-theft-extortion group known for sophisticated ransomware attacks and double extortion tactics. They have exploited vulnerabilities such as hardcoded credentials and misconfigured cloud permissions to gain access to targets, including Novo Nordisk and Arup Group. Their operations involve extensive dwell time, with claims of spending months analyzing stolen data before contacting victims. FulcrumSec has demonstrated a targeted approach, often demanding ransoms that are strategically calculated based on the victim's financial profile.

Recent activity

• PingCAP Data Breach Exposes Source Code and Cloud Control Plane Records PingCAP suffered a security breach claimed by the extortion group FulcrumSec. The hacker
  mastodon · Oct 25, 2026
• Rotate your exposed API keys and service account credentials immediately, and for the love of everything, enforce MFA on internal cloud management systems befor
  mastodon · Oct 23, 2026
• 🏆 New Achievement! Why Rob the Bank When You Own the Vault? Permit me to explain the elegance of what FulcrumSec pulled off against PingCAP, makers of the TiDB
  mastodon · Oct 23, 2026
• The PingCAP TiDB Cloud Leaks - FulcrumSec https:// infosec.pub/post/53964260 [ https:// infosec.pub/u/digicat ] # blueteamsec
  mastodon · Oct 23, 2026
• The PingCAP TiDB Cloud Leaks - FulcrumSec
  reddit · Oct 23, 2026

References

• https://www.resecurity.com/blog/article/cybercriminals-are-targeting-edtech-data-breaches-and-ransomware-attacks-on-the-rise
• https://blog.bushidotoken.net/2026/06/uk-cybercrime-journal-arup-group.html
• https://www.techrepublic.com/article/news-novo-nordisk-1-3tb-theft-25m-demand-emea/
• https://www.ransomlook.io/group/fulcrumsec

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.