How to lose 1.3TB of secrets, the Novo Nordisk way.

This month Novo Nordisk — the Danish pharmaceutical giant behind Ozempic and Wegovy — confirmed that attackers got into its systems [1]. The way in, researchers say, was a high-privileged access token sitting in the JavaScript of a forgotten, public-facing subdomain: a secret shipped to the browser, readable by anyone who opened View Source [2]. Careless, yes. But a company this size is not careless about credentials in general — it almost certainly runs serious credential management, the privileged-access machinery that governs who can log in where. None of it mattered, because all of it guards the wrong side of the house.

What actually happened

That first token was privileged enough to clone Novo Nordisk's private repositories. And the repositories were full of more credentials — because that is where machine credentials live, in nearly every company on earth: hard-coded in source, sitting in config, baked into CI pipelines, committed once and forgotten. Cloning the repos didn't just hand the attackers source code. It handed them the next set of keys, and the set after that.

That is how one careless token becomes total compromise. A group calling itself FulcrumSec says it pivoted this way for two and a half months and left with more than 700,000 files — roughly 1.3 terabytes — including source code, marketed and unreleased drug data, clinical-trial records, manufacturing technology, and the company's internal AI models [3]. When a reported $25 million ransom was refused, it began publishing the haul. (Novo Nordisk has confirmed unauthorized access to a limited number of systems; the full scope is the attackers' claim, not yet independently verified [1][3].)

One leaked token was the doorknob. The repositories full of standing credentials were the unlocked building behind it.

This isn't negligence. It's a category gap.

Enterprise credential management — the CyberArk-grade vaults, the privileged-access tooling every large company runs — was built for people: human accounts, login sessions, who-can-reach-what. It works, for that. The credentials that cascaded through this breach were on the other side entirely. The token in the JavaScript, the secrets in the repos, the keys in the CI pipeline are machine credentials — the ones apps, services, and now agents use to authenticate to each other, with no human in the loop. That side has never had a vault.

And it is the side that is exploding. Every new integration, every microservice, every AI agent you deploy multiplies the standing machine credentials nobody is governing. The danger moved to the app-and-agent side, and the tooling didn't move with it. So the post-mortems will land on "don't put tokens in JavaScript," and that fights the wrong battle. Tokens will always leak — into a log, a screenshot, a forgotten bundle. You cannot win at never exposing the first credential. What turned one leak into 1.3 terabytes was the building of standing machine credentials sitting behind it, in the code, waiting to be cloned. Get one, get the map to the rest.

Built for this, on purpose

That gap is the whole reason Clavitor exists: a vault for the side CyberArk was never built for — the credentials apps and agents use. With Clavitor there are no credentials in the repositories to harvest. The code never holds a secret it could commit; it asks the vault for the use of a credential at the instant it needs one, and the value never lands in the source, the config, or the build. An attacker who steals the first token and clones every repo you own finds exactly what should be there: code, and no keys. The chain that turns one leak into everything breaks at the first link.

The entry token is declawed the same way. A Clavitor credential is scoped to one action and it expires, so a token found in a stray bundle is no skeleton key — it can't clone the org or reach the next secret, because it was only ever good for the one thing it was named to do. It is bound to the machine it was issued to, so a copy used elsewhere is dead. No single credential becomes a quiet exfiltration pipe, either: every grant is rate-limited and trips a lockdown on an anomalous burst, so 700,000 files don't slip out one reasonable-looking request at a time over ten weeks. And every use is logged off the box and hash-chained, which makes a silent residency far harder to pull off when the record isn't on a machine the intruder owns.

None of this makes you unbreachable, and anyone promising that is selling. Hard-code a long-lived master key and whoever finds it can use it, once, for what it allows. What changes is that finding one credential no longer hands over the rest: no repository full of standing secrets behind it, no chain from the leak to the 1.3 terabytes. The blast radius of a leaked token shrinks back to the token.

The part worth keeping

The headline will be the drug formulas and the dark-web auction, and that is the part that stings. The lesson is quieter: a sophisticated company with real credential management still went 1.3 terabytes deep — because its vault watched the people while the breach walked in through the apps. Machine credentials are where the danger is now, and they are the one side still sitting in the open. The answer isn't scrubbing your repos clean — it's a credential that was never standing in them to scrub, one that even when stolen is good for a single scoped action, with no cabinet of keys behind it. The leak stays a leak. It just stops being the keys to everything.

We wrote down the rules a credential tool should keep for the app-and-agent side — the full ten are here.

Clavitor (@clavitorai) is the credential vault built for AI agents, and against them. clavitor.ai

Sources

[1] Novo Nordisk (@novonordisk) — Incident update. Confirms unauthorized access to a limited number of its internal IT systems.

[2] CybelAngel (@CybelAngel) — Novo Nordisk Was Breached Through JavaScript: what the coverage got wrong. Traces initial access to a high-privileged access token left in minified client-side JavaScript on a forgotten public-facing subdomain.

[3] TechRepublic (@TechRepublic) — Ozempic Maker Novo Nordisk Confirms Security Incident After $25M Hacker Demand. The group FulcrumSec claims a ~2.5-month dwell and ~700,000 files / 1.3TB — source code, marketed and unreleased drug data, clinical-trial records, and internal AI models — after cloning repositories and harvesting further credentials; data leaking after the ransom was refused.