fulcrumsec
First seen May 1, 2026Active29 claimed victims
The claims below are reproduced as posted by fulcrumsec on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption, with known victims including Australian fintech youX and LexisNexis.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| EMARKETER | October 23, 2026 | ransomlook | — |
| PingCAP / TiDB Cloud | October 19, 2026 | ransomlook | — |
| Dustin Group | September 11, 2026 | ransomlook | — |
| Manchester Airports Group | September 1, 2026 | ransomlook | — |
| Novo Nordisk | June 16, 2026 | ransomware_live | — |
| Global Schools Foundation | June 10, 2026 | ransomware_live | — |
| Arup Group | May 10, 2026 | ransomware_live | — |
| Stuf Storage | May 8, 2026 | ransomware_live | — |
| Fashinza | May 1, 2026 | ransomware_live | — |
| CrediElite | May 1, 2026 | ransomware_live | — |
| Crank Communications | May 1, 2026 | ransomware_live | — |
| BookBlock | May 1, 2026 | ransomware_live | — |
| JOT | May 1, 2026 | ransomware_live | — |
| Rotary Club | May 1, 2026 | ransomware_live | — |
| Raptor Supplies | May 1, 2026 | ransomware_live | — |
| IMEVI | May 1, 2026 | ransomware_live | — |
| Interzero | May 1, 2026 | ransomware_live | — |
| Saleskido | May 1, 2026 | ransomware_live | — |
| ParkEngage | May 1, 2026 | ransomware_live | — |
| Nordstern Technologies | May 1, 2026 | ransomware_live | — |
| Analog Gold / Prospector | May 1, 2026 | ransomware_live | — |
| Hatica | May 1, 2026 | ransomware_live | — |
| ReFocus AI | May 1, 2026 | ransomware_live | — |
| MCO | May 1, 2026 | ransomware_live | — |
| LexisNexis | May 1, 2026 | ransomware_live | — |
| youX / Drive IQ | May 1, 2026 | ransomware_live | — |
| Woundtech | May 1, 2026 | ransomware_live | — |
| Lena Health | May 1, 2026 | ransomware_live | — |
| Avnet | May 1, 2026 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).