CREDENTIALS IN CLIENT-SIDE JAVASCRIPT, TWICE: THE NOVO NORDISK AI ECOSYSTEM BREACH

According to BankInfoSecurity, extortion gang Fulcrumsec leaked Novo Nordisk's complete enterprise Hugging Face AI ecosystem August 12-13: 30 AI models, 70 datasets, and half a terabyte of proprietary cell painting microscopy images.

The initial access method was credentials left in client-side JavaScript on two separate unrelated Novo Nordisk subdomains. Two different teams. Two different applications. The same elementary mistake, made twice.

This isn't a sophisticated attack. It's not a zero-day. It's not even a novel technique. Credentials in client-side JavaScript is a security 101 failure – the kind of mistake that gets caught in code review if code review is happening, and gets flagged by automated scanning if automated scanning is running.

When the same mistake appears twice, across different teams and different applications, that's not two developers who didn't know better. That's a systemic failure in secure development lifecycle. It means code review isn't catching it. It means automated scanning isn't running, or isn't configured to flag exposed secrets, or is running and the findings are being ignored. It means security isn't a gate – it's a suggestion.

The breach started in June 2026. Fulcrumsec leaked the AI ecosystem in August. That's the entire enterprise Hugging Face infrastructure – models, datasets, proprietary microscopy – exposed because production JavaScript handed over the keys.

Here's the math: Novo Nordisk is a pharmaceutical company with a market cap over $400 billion. They have the budget for security tooling. They have the budget for training. They have the budget for code review and secure development lifecycle enforcement. What they didn't have was a process that made "don't put credentials in client-side JavaScript" mandatory instead of recommended.

The consequence is half a terabyte of proprietary research and 30 AI models in the hands of an extortion gang. The economic damage from this breach – lost competitive advantage, regulatory penalties, remediation costs – will dwarf whatever they would have spent making secure development mandatory.

This is the pattern: security spending is optional until the breach makes it retroactively mandatory, and by then the cost is 10x what prevention would have been. The credentials were in public JavaScript. Anyone could have found them. Fulcrumsec just happened to be first.

The fix is straightforward: scan client-side code for exposed secrets before deployment, enforce code review that includes security checks, and make passing those gates a hard requirement for production release. Not a recommendation. Not a best practice. A gate.

If Novo Nordisk had done that in May, the June breach wouldn't have happened. If they'd done it after the first subdomain, the second one wouldn't have fallen the same way. The failure wasn't technical. It was organizational.

And now their complete AI ecosystem is public.