LexisNexis Legal & Professional AWS Breach and FulcrumSec Data Leak

LexisNexis Legal & Professional confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias FulcrumSec leaked roughly 2 GB of allegedly stolen files on underground forums. LexisNexis stated the exposed information was mostly legacy/deprecated data from prior to 2020 (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found no evidence of impact to products or services; the company reported the matter to law enforcement and engaged an external forensics firm.

FulcrumSec claimed the intrusion began by exploiting the React2Shell vulnerability in an unpatched React frontend application to gain access to LexisNexis’ AWS environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., .gov email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.