Credential Management Failures Behind Major Cyber Incidents

This week the pattern is not a clever exploit. It is a long-lived credential, a token sitting in plain sight, a single hijacked account, and a billing system one network hop from a GPS correction tool. Three of the four incidents below required no zero-day at all. Attackers did not need to break anything; they only needed organizations to keep using passwords, tokens, and accounts longer than they should have.

A self-feeding credential harvesting operation has compromised more than 30,000 Fortinet firewalls and VPN gateways across 194 countries by reusing passwords leaked in older breaches. A pharmaceutical giant lost 1.3 terabytes of drug pipeline and clinical trial data to a single exposed GitHub access token. France’s sovereign government messaging platform was breached through a hijacked civil servant account and a set of hardcoded LDAP credentials nobody had rotated. And an Iran-linked hacktivist group pivoted from an internet-exposed GPS correction tool into a water utility’s billing systems, two days after US strikes on Iranian targets.

This week: a firewall vendor’s entire install base treated as already compromised, a drugmaker’s two-month-long silent intrusion through its own developer tooling, a government chat app where the breach-to-disclosure gap was short but the blast radius was not, and what happens when geopolitical retaliation finds the softest system in a water utility’s network.

FortiBleed: Self-Sustaining Credential Harvesting Against 30,000+ Fortinet Devices

What happened:

Security researchers at SOCRadar uncovered an active credential harvesting campaign, dubbed FortiBleed, after stumbling onto an exposed operational server belonging to the attackers themselves. The database on that server contained verified, working login credentials for more than 30,791 Fortinet firewalls and VPN gateways across 194 countries, spanning government, telecommunications, healthcare, education, financial services, and critical infrastructure organizations. The operation is suspected to involve Russian-speaking threat actors and remains active as of this writing.

Technical details that matter:

There is no exploited vulnerability here, despite the name. SOCRadar explicitly found no evidence of an actual Fortinet flaw being used. The mechanism is credential reuse, credential stuffing, and password spraying against exposed Fortinet management and VPN interfaces, using passwords leaked in prior Fortinet-related breaches that victim organizations never rotated. Many of the compromised accounts were generic administrator logins, default or built-in Fortinet system accounts, or long-lived credentials untouched since earlier incidents.

What makes this self-sustaining is the second stage: once a device is compromised, attackers use it as a listening post, sniffing traffic that passes through it for additional credentials, then feeding those fresh captures back into the automated scanning infrastructure to compromise the next device. SOCRadar’s report put it plainly: the system feeds itself. Telecommunications accounted for over 5,600 compromised devices; government organizations represented 591 devices across 111 domains. Enterprises generating more than a billion dollars in annual revenue made up more than 20 percent of affected devices, and victim selection was reportedly weighted toward NATO member countries, with credentials recovered for what appears to be a defense industry VPN endpoint, suggesting a possible espionage motive layered on top of financial gain.

Why critical institutions should care:

This is the cheapest possible attack to run and the hardest to fully close out, because it does not depend on a patch cycle. It depends on every account, everywhere, having a unique password that was never reused and was rotated after the last time Fortinet had a breach. If your organization has ever appeared in a prior Fortinet-related credential leak and didn’t force a full rotation across every administrative and VPN account, you are statistically likely to be in this database right now. SOCRadar’s own guidance is unambiguous: if you appear in this dataset, treat your perimeter as already compromised, not potentially compromised. For healthcare and government operators specifically, the listening-post mechanic means a single unrotated password can quietly compound into months of intercepted internal traffic before anyone notices.

Key sources:

Novo Nordisk: A Single GitHub Token Opened Two Months Inside a Drugmaker’s Pipeline

What happened:

The extortion group FulcrumSec claims it gained initial access to Novo Nordisk in March through a high-privileged GitHub personal access token exposed in client-side JavaScript on an obscure subdomain, then spent more than two months moving laterally through the company’s Azure DevOps, GitHub, AWS, and HuggingFace environments. The group claims it exfiltrated roughly 1.3 terabytes across more than 700,000 files, including source code, undisclosed drug program data, proprietary compound structures, internal AI models, manufacturing details tied to the GLP-1 pipeline, and clinical trial data for approximately 11,500 pseudonymized participants. Novo Nordisk confirmed an IT security incident involving unauthorized access and external copying of non-public data, but has not validated the full scope FulcrumSec claims. After the company declined a reported 25 million dollar ransom demand, the group began leaking data and is now exploring private sales of the remainder.

Technical details that matter:

The entry point was identity, not a network perimeter. A single leaked GitHub PAT with broad, non-segmented read access across hundreds of unrelated repositories let attackers clone private code and search it for hardcoded secrets. They found exactly that: API tokens, database credentials, and service account passwords sitting inside the repositories themselves, which is what enabled the pivot from a developer-tooling foothold into production-adjacent cloud and research environments. One researcher’s framing is the sharpest summary available: the attackers did not break through the perimeter, they were authenticated the entire time. The absence of zero-trust segmentation between development environments and core research networks is what let a JavaScript bundle leak turn into access to a collaborative drug discovery database and live AI model weights.

Why critical institutions should care:

Every organization running CI/CD pipelines, internal AI models, or cloud-connected developer tooling has some version of this exposure today. The specific failure here, a long-lived, overprivileged, unrotated token, is mundane and extremely common. What is not mundane is the blast radius once that token grants lateral movement into systems holding regulated clinical trial data and proprietary IP that, by the attackers’ own claim, could save a competitor three to five years of R&D. For healthcare and life sciences leaders, this incident argues for treating ML model weights, training pipelines, and clinical data access at the same security tier as the patents and trial protocols they protect, not as a back-office engineering concern.

Key sources:

Tchap: France’s Sovereign Messaging Platform Breached Through a Hijacked Account and Hardcoded LDAP Credentials

What happened:

ANSSI, France’s national cybersecurity agency, detected a breach on Tchap, the mandatory government messaging platform used by more than 800,000 civil servants, on June 7. The attacker first compromised a legitimate user account through social engineering, then discovered hardcoded credentials embedded in Tchap’s LDAP authentication layer, which let them bypass the need to compromise accounts one at a time and move broadly across the platform. An attacker has claimed roughly 643,000 messages and 73,000 accounts were exposed, spanning nearly three years of activity in public chat rooms. DINUM, the agency that operates Tchap, disclosed the incident two days after detection and says private, end-to-end-encrypted conversations remain inaccessible regardless of account compromise; only unencrypted public room content was exposed.

Technical details that matter:

This was a two-stage technique, not a single exploit. Stage one was conventional credential theft through social engineering against an individual civil servant. Stage two is the part worth studying: once inside, attackers found static, hardcoded credentials in the LDAP configuration, the directory layer that handles identity verification across the platform. Unlike dynamically managed secrets, statically embedded LDAP credentials do not rotate when surrounding systems change, which gave the attacker an authentication path that scaled horizontally instead of requiring sequential account-by-account compromise. ANSSI’s detection-to-disclosure window of two days is faster than many comparable government incidents, but the 73,000 accounts and 643,000 messages already accessed indicate the attacker had enough time inside to move broadly before being caught.

Why critical institutions should care:

Tchap was built specifically to get government communications off foreign commercial platforms and onto sovereign, state-controlled infrastructure. The architecture did its job on the encryption side; private conversations held. But the breach is a clean illustration that platform sovereignty and platform security are different properties, and that an identity-layer weakness, hardcoded LDAP credentials nobody rotated, can undo a substantial part of the security model regardless of who built the software or where it runs. Any institution that has stood up its own messaging, intranet, or identity infrastructure as an alternative to commercial SaaS should treat this as a direct prompt to audit directory service configurations for static credentials, not just to trust that in-house equals secure.

Key sources:

Handala / Cal Water: A GPS Correction Tool Became the Path Into a Water Utility’s Billing Systems

What happened:

On June 11, the Iran-linked group Handala claimed responsibility for breaching California Water Service, the largest investor-owned water utility in the western United States, serving roughly 2 million customers across 100 communities. The group published a 5 gigabyte proof-of-concept dump and stated the attack was retaliation for US strikes on Iranian targets two days earlier. Independent analysis by Dataminr confirmed the breach reached a customer billing database and an internal RTKBase NTRIP GPS correction network spanning at least seven Cal Water service districts, exposing names, addresses, phone numbers, account numbers, and payment history. Cal Water has confirmed no disruption to water production or delivery systems and no compromise of operational technology.

Technical details that matter:

The pivot path is the technical story here. RTKBase is an open-source NTRIP caster, infrastructure that broadcasts high-precision GPS correction data to field survey and engineering equipment, an IT-adjacent tool that utilities often deploy with weaker access controls than core billing or SCADA systems because it is not seen as sensitive. Handala used administrative credentials and access to that GPS correction network as a foothold, then moved laterally into the customer billing database across multiple operational districts. Check Point Research and Dataminr both assess that operational technology and water treatment control systems were not reached, only IT-side billing and the GPS correction tooling. Handala, tracked by Microsoft as Storm-0842 and linked to Iran’s Ministry of Intelligence and Security, explicitly stated it chose not to disrupt water delivery, consistent with the group’s pattern of data theft and psychological operations preceding any move to destructive action.

Why critical institutions should care:

This incident is a direct, dated illustration of a pattern CISA warned about earlier this year: Iranian targeting of US water-sector technologies. The notable detail is timing, not technique. A kinetic strike was followed by a cyber claim within 48 hours, and the entry point was a peripheral IT tool that nobody had budgeted security attention to because it sits several systems away from the part of the network that controls water flow. Handala has a documented track record of data theft first, destruction later, having deployed a wiper against a medical device manufacturer in March. For utility and critical infrastructure operators, the lesson is that IT/OT segmentation has to be verified, not assumed, and that every internet-facing tool, including ones that seem unrelated to core operations like a GPS correction caster, is part of the actual attack surface.

Key sources:

The Pattern This Week

Four incidents, one common root cause: identity and credential hygiene failures, not novel exploitation. FortiBleed runs entirely on password reuse against firewalls that should have rotated credentials after prior breaches. Novo Nordisk lost two months of unrestricted lateral access to a single overprivileged token sitting in a JavaScript bundle. Tchap’s defenders held the encryption layer but lost the identity layer to a hijacked account and hardcoded directory credentials. Even Handala, a state-linked actor with destructive capability, didn’t need an exploit; it needed an internet-facing GPS tool with administrative credentials nobody was watching.

None of these attackers needed to be sophisticated. They needed defenders to have left a credential, a token, or an account exactly as long-lived and overprivileged as it had always been. That is the uncomfortable throughline: the technical sophistication required to cause material damage to a hospital-grade ERP system, a pharmaceutical giant’s IP, a sovereign government platform, or a water utility’s customer base has dropped to whatever it takes to find one unrotated secret.

See you next week.

What Your Business Can Do This Week

Rotate and segment every long-lived credential tied to perimeter and remote-access devices. If your organization runs Fortinet firewalls or VPN gateways, assume compromise if you have ever appeared in a prior Fortinet-related breach and have not since forced a full rotation of administrative and VPN credentials. Enable MFA on every remote-access and admin account, and pull management interfaces off the public internet wherever possible.
Audit every developer-facing access token for scope and lifetime, not just existence. The Novo Nordisk intrusion ran for two months because one token had broad, non-segmented read access across hundreds of repositories. Inventory every GitHub, GitLab, and cloud-API personal access token in use, eliminate long-lived PATs in favor of short-lived, identity-bound tokens, and verify that no API keys, database credentials, or service account passwords are hardcoded inside your own repositories.
Treat internal identity infrastructure with the same scrutiny as customer-facing systems. Tchap’s encryption held but its LDAP layer didn’t. Audit your own directory services, whether Active Directory, LDAP, or a custom identity layer, for hardcoded or static credentials that never rotate when the rest of the environment changes.
Map your IT/OT boundary by testing it, not assuming it. Cal Water’s billing systems and GPS correction tooling sat reachable from the same access path; the only thing that kept this from becoming a control-systems incident was that this particular actor chose not to escalate. Identify every peripheral, seemingly low-risk IT tool in your environment, GPS correction servers, building management systems, anything internet-facing, and verify it cannot reach anything that touches physical operations.

FortiBleed: Self-Sustaining Credential Harvesting Against 30,000+ Fortinet Devices

Novo Nordisk: A Single GitHub Token Opened Two Months Inside a Drugmaker’s Pipeline

Tchap: France’s Sovereign Messaging Platform Breached Through a Hijacked Account and Hardcoded LDAP Credentials

Handala / Cal Water: A GPS Correction Tool Became the Path Into a Water Utility’s Billing Systems

The Pattern This Week

What Your Business Can Do This Week

Like this:

Ready to Strengthen Your Defenses?

Satine Sentinel: June 19, 2026

FortiBleed: Self-Sustaining Credential Harvesting Against 30,000+ Fortinet Devices

Novo Nordisk: A Single GitHub Token Opened Two Months Inside a Drugmaker’s Pipeline

Tchap: France’s Sovereign Messaging Platform Breached Through a Hijacked Account and Hardcoded LDAP Credentials

Handala / Cal Water: A GPS Correction Tool Became the Path Into a Water Utility’s Billing Systems

The Pattern This Week

What Your Business Can Do This Week

Share this:

Like this:

Ready to Strengthen Your Defenses?