A pattern, not a coincidence
Over the past year, one extortion group has broken into at least four large organisations using the same basic move: finding an access key or token that a developer left sitting in code the public could already see, then using it to walk into far more sensitive systems. Security researchers at Sysdig, who track the group under the name FulcrumSec (also called "The Threat Thespians"), say it has been active since September 2025 and claims roughly 25 victims across 11 countries, most of them headquartered in the United States.
The method barely counts as hacking in the traditional sense. No malware, no phishing email, no exploited zero-day. Just a JavaScript file or a code repository, read the way anyone can read one, with a working credential inside it.
The airport operator that never rotated a key
The most recent and most vivid case is Manchester Airports Group (MAG), which operates Manchester, London Stansted and East Midlands airports in the United Kingdom. Security researcher Scott Helme found that an application programming interface (API) key for Iterable, a marketing automation platform, had been embedded in public-facing JavaScript on all three airports' websites since June or July 2022 and was never rotated. The key did not just allow reading customer data; it could delete customer records and mailing lists and rewrite profiles.
"For four whole years, the capability to delete Manchester Airports Group's database was a view-source away," Helme wrote. He added a pointed caveat about the limits of after-the-fact investigation: "There is no way to know, from the outside, who else did, and the honest answer is that MAG can't know either."
MAG told customers in late August that an unauthorised third party had stolen data, describing it as a sophisticated attack rather than an internal lapse. After MAG refused to pay a ransom, FulcrumSec published the stolen data on September 2. SecurityWeek reported the haul covers roughly 8.8 million people, including names, email addresses, phone numbers, postcodes, internet protocol (IP) addresses, vehicle registration plates tied to parking bookings, and more than 2.4 million parking, lounge and Fast Track purchase records, plus over 460,000 short message service (SMS) text messages linked to bookings.
The same trick, three more times
The Manchester Airports Group breach is not an isolated case for this group; it is close to a template. Danish drugmaker Novo Nordisk disclosed in June that hackers had accessed "a limited number of internal IT systems." According to GovInfoSecurity, the actual entry point was an Azure DevOps personal access token hardcoded into a minified JavaScript bundle on one of the company's subdomains, plus a separate GitHub personal access token exposed in client-side code on another. Those tokens let the attackers move laterally across Azure DevOps, GitHub, Amazon Web Services (AWS) and Hugging Face for roughly two months before GitHub and Azure's own anomaly detection caught the activity. FulcrumSec claimed 1.3 terabytes of stolen material, including drug research, internal artificial intelligence models, source code, and clinical trial records tied to about 11,500 patients, and demanded $25 million. Novo Nordisk refused, and the data was leaked starting June 15.
UK engineering firm Arup Group, known for work on the Sydney Opera House and parts of the High Speed 2 (HS2) rail project, lost even more. FulcrumSec first got in during September 2025 through a GitHub personal access token hardcoded in JavaScript on a forgotten subdomain, which opened access to more than 10,000 private repositories. From there the group spent months quietly pulling roughly 700 gigabytes of GitHub repositories and about 2 terabytes of Azure and AWS storage, including HS2-related files, Euston Station design documents, and, according to researchers tracking the leak, Apple code-signing certificates stored with their passwords in plain text. Arup detected part of the intrusion about six weeks in, but a ransom negotiation dragged on for seven months before collapsing, after which the full archive was published.
Global Schools Group, a Singapore-based operator of international school brands across nine countries, was breached in a similar fashion in April 2026, exposing personal data belonging to students and staff, some of them minors, across a platform shared by multiple school brands. Singapore's High Court issued an injunction against further disclosure in June; FulcrumSec said publicly that it would make no difference to its plans, and Singapore's Personal Data Protection Commission opened an investigation.
What this means in practice
The common thread across all four cases is not a sophisticated exploit. It is a credential that was written into code meant to run in someone else's browser, or committed to a repository that turned out to be reachable from the outside, and then never rotated even after the risk should have been obvious. Any secret that ships to a browser is public the moment it ships, regardless of how obscure the file or subdomain seems.
For engineering and security teams, the practical response is unglamorous but well understood: run automated secret scanning across both source repositories and the actual JavaScript bundles served to users, not just the code as written; rotate API keys on a schedule rather than only after an incident; and issue keys scoped to the narrowest permission they need, so that a marketing analytics key, for instance, cannot also delete a customer database. For everyone else, the lesson is more sobering: a company can suffer a serious breach without anyone breaking anything, simply because a credential sat in plain view for years.
