Loading story…
LexisNexis shut down Nexis Diligence, Nexis Metabase API, and Nexis Newsdesk after detecting suspicious activity on servers hosted and managed by an unnamed third-party vendor. The company said it disconnected from the affected vendor systems to contain the incident and protect customers, and has brought in a cybersecurity forensic firm to investigate while rebuilding impacted systems in a new environment before restoring service.
LexisNexis said the Nexis Metabase API is not connected to Metabase Cloud and is unrelated to the recently disclosed Metabase SQL injection zero-day. The outage follows earlier LexisNexis security incidents reported in 2025, including a breach affecting more than 364,000 individuals tied to exposed private GitHub repositories and a separate compromise of AWS-hosted infrastructure in which stolen files were later leaked.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
In May 2025, LexisNexis disclosed a cybersecurity incident involving unauthorized access to its private GitHub repositories. The theft exposed personal data belonging to about 364,000 individuals.
LexisNexis previously confirmed that a limited number of servers were accessed without authorization during the March 2025 incident. The company said those servers contained mostly legacy data.
In March 2025, LexisNexis was targeted in an attack attributed to FulcrumSec, which exploited the React2Shell flaw in the company's AWS infrastructure. The attackers stole private files and later leaked them.
Following the shutdown, LexisNexis said it was investigating the incident with help from a cybersecurity forensic firm and rebuilding affected systems in a new environment before restoring service. The company also stated that Nexis Metabase API is unrelated to Metabase Cloud and its recently disclosed zero-day.
Earlier in the week of the reports, LexisNexis detected unusual activity on servers hosted and managed by an unnamed third-party vendor and took Nexis Diligence, Nexis Metabase API, and Nexis Newsdesk offline. The company disconnected from the affected systems to contain the issue and protect customers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
dysruptionhub.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**LexisNexis Legal & Professional** confirmed that an unauthorized party accessed a limited number of its servers after a threat actor using the alias **FulcrumSec** leaked roughly **2 GB** of allegedly stolen files on underground forums. LexisNexis stated the exposed information was **mostly legacy/deprecated data from prior to 2020** (e.g., customer names, user IDs, business contact details, products used, customer survey data including respondent IP addresses, and support tickets) and said it found **no evidence of impact to products or services**; the company reported the matter to law enforcement and engaged an external forensics firm. FulcrumSec claimed the intrusion began by exploiting the **React2Shell** vulnerability in an **unpatched React frontend application** to gain access to LexisNexis’ **AWS** environment, and alleged broader access within cloud resources (including an ECS task role and data stores) and the presence of government-related accounts (e.g., `.gov` email addresses) in the stolen dataset. Public reporting notes a discrepancy between the actor’s claims (e.g., “millions of records,” passwords, and other internal artifacts) and LexisNexis’ characterization of the exposed data as limited and non-sensitive (no SSNs, financial data, active passwords, or customer search queries), but multiple outlets corroborated that the leaked files are tied to a real, now-contained incident affecting LexisNexis’ Legal & Professional division.
Jun 29, 2026
Metabase disclosed a **critical unauthenticated SQL injection zero-day** affecting `1.58+` that was actively exploited against Metabase Cloud tenants and vulnerable self-hosted deployments. The company said the flaw could give remote attackers administrator access and enable theft of stored database credentials and accessible data; it has since blocked the attack paths and released fixes. Metabase rated the issue `CVSS 10.0` and urged self-hosted customers to upgrade, revoke sessions, rotate credentials, and review logs for signs of compromise. The downstream impact has already hit multiple organizations. Framework told customers that attackers breached its Metabase-hosted cloud instance through the upstream provider and stole personal data affecting **all customers**, including names, email addresses, phone numbers, and physical addresses, but not payment information. Tally separately said an attacker accessed its Metabase analytics service and obtained user email addresses and password hashes, while stating that forms and submitted responses were stored separately and were not accessed. LexisNexis also reported disruption and unusual activity involving systems connected to its Metabase API through a third-party vendor.
Sep 3, 2026
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against **Metabase Cloud**, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, `CVE-2026-72898` and `CVE-2026-72899`, and a missing authorization vulnerability, `CVE-2026-72900`. According to the advisories, `CVE-2026-72898` can be abused through the `/reset_password` database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited. Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than **63.5, 62.9, 61.11, 60.17, 59.21, and 58.24** should be upgraded to those fixed versions or later across the supported `0.58.x` to `0.63.x` branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Aug 12, 2026