How a Single Overprivileged Service Turned the LexisNexis Breach Into a Keys-to-the-Kingdom Moment

LexisNexis confirmed a major AWS breach initiated via the 'React2Shell' vulnerability in an unpatched React frontend. The attacker, FulcrumSec, claims the compromised ECS task role had read access to 53 entries in AWS Secrets Manager, exposing credentials for GitHub, Azure DevOps, Databricks, Salesforce, and analytics platforms. The incident illustrates how overprivileged workload identities can turn a single application compromise into a broad credential exposure. Key mitigations include applying least-privilege IAM policies, using short-lived credentials, segmenting secrets by environment, and auditing which identities can retrieve secrets. The post is authored by Aembit, a secrets management vendor.