Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Fulcrumsec
As of Oct 19, 2026, Fulcrumsec has listed 29 confirmed victims on its leak site since Apr 29, 2026, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (48.3% of its victims) and its most targeted sector is Technology.
FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption, with known victims including Australian fintech youX and LexisNexis.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 29
- Rank By Victims
- #141
- Last Leak-Site Post
- Oct 19, 2026
- Top Country
- United States
- Top Sector
- Technology
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 4 |
| June 2026 | 2 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 2 |
| October 2026 (month in progress) | 1 |
| Month | Confirmed victims |
|---|---|
| April 2026 | 20 |
| May 2026 | 4 |
| June 2026 | 2 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 2 |
| October 2026 (month in progress) | 1 |
| Month | Confirmed victims |
|---|---|
| April 2026 | 20 |
| May 2026 | 4 |
| June 2026 | 2 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 2 |
| October 2026 (month in progress) | 1 |
Latest Fulcrumsec Victims.
Search all 29 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| PingCAP / TiDB Cloud pingcap.com | USUnited States | Technology | Not stated | |
| Dustin Group dustingroup.com | SESweden | Technology | Not stated | |
| Manchester Airports Group magairports.com | GBUnited Kingdom | Transportation and Logistics | Not stated | |
| Novo Nordisk novonordisk.com | DKDenmark | Pharmaceuticals | Not stated | |
| Global Schools Foundation globalschools.com | SGSingapore | Education and Research | Not stated | |
| Arup Group arup.com | GBUnited Kingdom | Consulting | 5 TB |
How They Operate.
Fulcrumsec's threat actor profile lists 4 ATT&CK techniques, 1 exploited CVEs, 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Fulcrumsec Targets.
Sectors
History.
Busiest month on record: 20 confirmed victims
First confirmed victim listed on its leak site
First seen in Brandefense data
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.