Data Breach at LexisNexis: Hackers Expose Customer and Business Information
American data analytics company LexisNexis Legal & Professional has confirmed a data breach, revealing that hackers accessed customer and business information. The breach occurred due to a React frontend app vulnerability, which was exploited by a threat actor named FulcrumSec.
LexisNexis L&P, a global provider of legal, regulatory, and business information, faced a significant security incident. The company's investigation revealed that the breach involved legacy data from before 2020, including customer names, user IDs, business contact details, product usage, and survey data. Importantly, no sensitive information such as Social Security numbers, financial data, or active passwords was compromised.
FulcrumSec, the threat actor, claimed to have stolen data related to over 100 users with .gov email addresses, including U.S. government employees, federal judges, and law clerks, as well as Department of Justice attorneys and SEC staff. The hacker detailed the intrusion, accessing a vast amount of data from LexisNexis' AWS infrastructure, including Redshift tables, VPC database tables, secrets, and user profiles.
Despite the breach, LexisNexis believes the intrusion was contained and has no evidence of product or service impact. The company has taken responsibility, notifying customers and law enforcement, and engaging an external cybersecurity expert for investigation and containment measures. This incident highlights the evolving nature of cyber threats, with malware becoming more sophisticated, as evidenced by the Red Report 2026, which discusses the decline in ransomware encryption and the use of advanced techniques to evade detection.
