LexisNexis confirms data breach as hackers leak stolen files

 

In early March 2026, LexisNexis Legal & Professional, a prominent American data analytics firm serving lawyers, corporations, governments, and academic institutions across more than 150 countries, publicly confirmed a significant security breach after a hacker group known as FulcrumSec began leaking stolen files online. The incident came to light when FulcrumSec posted roughly 2 gigabytes of data on underground forums, claiming it included sensitive details from LexisNexis's AWS cloud infrastructure. The group detailed their method of attack, revealing they exploited a known vulnerability called React2Shell in an unpatched React frontend application on February 24, granting them access to a vulnerable container with broad permissions.

LexisNexis acknowledged the unauthorized access in a statement to reporters, describing it as limited to a small number of servers holding mostly outdated data from before 2020. According to the company, the compromised information consisted of legacy records such as customer names, user IDs, business contact details, product usage history, customer survey responses linked to IP addresses, and support ticket logs. Importantly, the firm emphasized that no highly sensitive personal identifiers like Social Security numbers, driver's license numbers, financial account details, active passwords, or client matter files were exposed, and their core products and services remained unaffected.

FulcrumSec painted a more alarming picture in their manifesto, asserting they exfiltrated structured data totaling over 3.9 million records from production databases, including a Redshift enterprise data warehouse with 536 tables and more than 430 additional database tables. Among the haul, they highlighted profile data for approximately 400,000 users, notably over 100 with .gov email addresses tied to U.S. government personnel such as federal judges, law clerks, Department of Justice attorneys, and SEC staff. The hackers criticized LexisNexis's security setup, pointing out that a single ECS task role had read access to every secret in the account, including production database master credentials stored in AWS Secrets Manager, from which they extracted 53 secrets.

Despite attempts by FulcrumSec to engage LexisNexis for responsible disclosure, the company declined collaboration, prompting the public leak. In response, LexisNexis swiftly notified law enforcement, hired an external cybersecurity firm to investigate, and implemented containment measures, believing the breach fully secured with no ongoing threat. They also reached out to potentially impacted current and former customers. This event marks the second major breach for the company in less than a year, following a 2025 incident where attackers accessed a corporate GitHub account, exposing personal data of 364,000 individuals including Social Security numbers.

The breach underscores persistent vulnerabilities in cloud environments, particularly around unpatched applications and overly permissive access controls in tools like AWS ECS and Secrets Manager. For LexisNexis, a key player in legal research and risk analytics, the fallout could erode trust among high-stakes clients reliant on its platforms for confidential work. Industry observers note it as a reminder for organizations to prioritize timely patching, least-privilege principles, and proactive threat hunting, especially as threat actors increasingly target data-rich sectors like legal tech. As investigations continue, affected parties are advised to monitor accounts and watch for phishing attempts leveraging the leaked data.