LexisNexis has confirmed a data breach at its Legal & Professional division after the Fulcrumsec cybercrime group claimed responsibility. The attackers allegedly exploited an unpatched React2Shell vulnerability in a React container on an AWS instance, exfiltrating approximately 2 GB of data. LexisNexis states only a limited number of servers were accessed, containing mostly legacy data from before 2020, including customer names, user IDs, business contact info, and support tickets. No Social Security numbers, financial data, or active passwords were compromised. Fulcrumsec claims the haul includes 400,000 cloud user profiles, 3.9 million database records, 53 secrets from AWS Secrets Manager, and over 300,000 customer contract records revealing pricing and product subscriptions for law firms, government agencies, and universities.
Sort: