FulcrumSec Report Says React2Shell Exploit Exposed Data at Three Firms
Summary
FulcrumSec's report says an unpatched internet-facing host vulnerable to CVE-2025-55182 exposed ECS credentials, 57 S3 buckets and Secrets Manager across three firms, including data on about 23,000 policyholders and proprietary ML assets.
Key points
- FulcrumSec reports that attackers exploited CVE-2025-55182 (React2Shell) on an unpatched internet-facing host to obtain ECS credentials.
- The report says the credentials enabled access to 57 S3 buckets and AWS Secrets Manager across Unique Computing, ReFocus AI, and Gennet AI.
- It says the firms shared a single AWS account without separation or isolation.
- The reported exposure includes records for about 23,000 insureds, with driver license numbers and Social Security numbers; the report gives aggregate premiums of $796,847,366.
- The report says ReFocus AI's proprietary ML pipeline and artifacts were exposed, including 11 client churn models and 713 data intake files.
- FulcrumSec accused Unique Computing of failing to patch and not cooperating after the incident; the article provides no independent confirmation of the reported access or exposure.
Article Details
- Victim Organization
- Unique Computing, ReFocus AI, and Gennet AI
- Incident Type
- Reported exploitation of an unpatched internet-facing host via CVE-2025-55182 (React2Shell), followed by use of ECS credentials to access cloud storage and secrets.
- Data Types Exposed
- Insurance policyholder records
- Driver license numbers
- Social Security numbers (SSNs)
- Proprietary machine-learning models, production artifacts, and pipelines
- Company and education data
- Affected Records
- Roughly 23,000 named insureds across 11+ agencies; the report also identifies 713 data intake files.
- Operational Impact
- The report says a compromised credential allowed access to 57 S3 buckets and AWS Secrets Manager shared across the three organizations, exposing linked data. ReFocus AI's reported exposed materials included 11 client churn models, production artifacts, and feature-engineering pipelines.
- Ransom Or Extortion
- No ransom demand or extortion activity is reported. FulcrumSec reportedly offered compensation to affected Patriotic Insurance policyholders.
- Claim Status
- claimed
MITRE ATT&CK
T1078.004 · Cloud AccountsThe report says attackers obtained ECS credentials and used them to access cloud resources.T1190 · Exploit Public-Facing ApplicationThe report says attackers exploited CVE-2025-55182 on an unpatched internet-facing host.T1530 · Data from Cloud StorageThe report describes access to 57 S3 buckets containing exposed data.
CVE
Vendors
Products
Amazon ECSCVE-2025-55182 (React2Shell) exploited on an unpatched internet-facing host allowed attackers to obtain ECS credentials and access 57 S3 buckets and AWS Secrets Manager across Unique Computing, ReFocus AI, andAWS Secrets Managerinternet-facing host allowed attackers to obtain ECS credentials and access 57 S3 buckets and AWS Secrets Manager across Unique Computing, ReFocus AI, and Gennet AI.S3exploited on an unpatched internet-facing host allowed attackers to obtain ECS credentials and access 57 S3 buckets and AWS Secrets Manager across Unique Computing, ReFocus AI, and Gennet AI.