Search threats, CVEs… ⌘K
← Back to all threat actors

fulcrumsec

Also known as The Threat Thespians

FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption, with known victims including Australian fintech youX and LexisNexis.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-05-01
Last seen
2026-09-11
Sectors
technology, business-services, healthcare, consumer-services, financial-services, education, transportation, manufacturing, professional-services, telecommunication
Status
Active

Threat intelligence assessment

At a glance

Facts

  • Financially motivated data-extortion group active since 2025

Operational playbook

Facts

  • Steals sensitive corporate data and threatens to publish it rather than encrypting victims' systems
  • Demands monetary ransom from victims

Initial access and identity targets

Facts

  • Obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript

Capabilities and evasion

Facts

  • Capable of exfiltrating large volumes of data (86 GB in Manchester Airports case)

Communication and pressure channels

Facts

  • Communicated with BleepingComputer claiming responsibility and sharing data samples
  • Stated intention to publish stolen data and technical account of intrusion
  • Considered withholding or redacting records because of potential for real-world harm

Named victims

Organizations

  • Manchester Airports Group
  • LexisNexis
  • Novo Nordisk
  • Global Schools Group
  • Avnet

Reported detail

Facts

  • FulcrumSec claimed responsibility for breaching Manchester Airports Group and stealing approximately 86 GB of data including customer bookings, travel information, and personal identifiers.
  • The group accessed systems using exposed Iterable API credentials found in client-side JavaScript code.
  • Stolen data included consolidated customer profiles with historical booking activity, marketing classifications, and nearly 200,000 records of upcoming travel in 2026.
  • FulcrumSec is a financially motivated extortion group active since 2025 that has previously targeted LexisNexis, Novo Nordisk, Global Schools Group, and Avnet.
  • Manchester Airports Group refused to pay the demanded ransom and stated it had taken protective measures, though it declined to address specific claims about the breach scope.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimDustin Group listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator4 indicators cataloged

Types: domain, onion.

Cataloged
Indicator1 indicator cataloged

Types: tool.

Disclosed
Victim claimManchester Airports Group confirmed a breach

The organisation has publicly confirmed a breach. That confirmation covers the incident, not the attribution to fulcrumsec.

Confirmed
Cataloged
IdentityAlias: The Threat Thespians

Reviewed identity mapping approved on this date.

Claimed
Victim claimLexisNexis listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator2 indicators cataloged

Types: url.

Cataloged
Indicator1 indicator cataloged

Types: tool.

Cataloged
CVECVE-2025-55182 linked to this actor

The FulcrumSec playbook: How to detect and stop the group behind the Novo Nordisk breach | Sysdig

First listed
Victim claimGlobal Schools Foundation listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimNovo Nordisk listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimArup Group listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimStuf Storage listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAvnet listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLena Health listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMCO listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimReFocus AI listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimHatica listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAnalog Gold / Prospector listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimNordstern Technologies listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimParkEngage listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSaleskido listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimInterzero listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimIMEVI listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRaptor Supplies listed by fulcrumsec

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 33 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

fulcrumsecCanonical Name
The Threat ThespiansAlias

Loading CVEs, techniques, indicators, malware, victims, and activity...