cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

LexisNexis Confirms Breach After FulcrumSec Leaks Stolen Files

· Original article ↗

Summary

LexisNexis confirmed unauthorized access to a limited number of servers, while FulcrumSec claims it exploited an unpatched React app and leaked 2.04 GB. The company says mostly pre-2020 data was affected and the intrusion is contained.

Key points

  • LexisNexis confirmed an unauthorized party accessed a limited number of servers.
  • FulcrumSec claims it gained access to the company’s AWS infrastructure on February 24 by exploiting a vulnerable React frontend app.
  • FulcrumSec says it exfiltrated 2.04 GB of data and accessed around 400,000 cloud user profiles; these scope claims are not independently confirmed in the article.
  • LexisNexis says the affected servers held mostly legacy data from before 2020, including customer names, user IDs, business contact details, survey responses with IP addresses, and support tickets.
  • The company says the affected information did not include active passwords, financial information, or the sensitive personal and customer data it lists as excluded.
  • LexisNexis says it believes the intrusion is contained, found no evidence products or services were affected, notified law enforcement, and engaged an external cybersecurity expert.

Article Details

Victim Organization
LexisNexis Legal & Professional
Incident Type
Unauthorized access to servers in LexisNexis AWS infrastructure. FulcrumSec claims it gained access on February 24, 2026, by exploiting the React2Shell vulnerability in an unpatched React frontend app.
Incident Date
2026-02-24
Disclosure Date
2026-03-03
Data Types Exposed
  • Customer names and user IDs
  • Business contact information
  • Products used
  • Customer surveys, including respondent IP addresses
  • Support tickets
  • FulcrumSec claims access to cloud user profiles containing names, email addresses, phone numbers, and job functions
  • FulcrumSec claims access to 45 employee password hashes; the company said active passwords were not exposed
Affected Records
The company described a limited number of servers and mostly legacy data but did not provide a record count. FulcrumSec claims 3.9 million database records, 21,042 customer accounts, 5,582 attorney survey respondents, and access to around 400,000 cloud user profiles; these quantities were not confirmed by the company.
Affected Data Size
FulcrumSec claims it exfiltrated 2.04 GB of data. The company did not confirm this amount.
Operational Impact
LexisNexis says it believes the intrusion has been contained and found no evidence that its products or services were impacted.
Ransom Or Extortion
FulcrumSec says it contacted LexisNexis and claims the company declined to work with it; the actor subsequently leaked files. No ransom demand is reported.
Claim Status
confirmed

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationFulcrumSec claims it exploited the React2Shell vulnerability in an unpatched React frontend app to gain access to the company's infrastructure.

Threat Actors

fulcrumsecClaims responsibility for the intrusion, data exfiltration, and leak. LexisNexis confirmed unauthorized access but did not independently confirm FulcrumSec's account of the intrusion or the quantities it reported.

Products

AWSThe threat actor says that on February 24 they gained access to the company's AWS infrastructure by exploiting the React2Shell vulnerability in an unpatched React frontend app.

Countries

United StatesIn a public post detailing the hack, FulcrumSec claims that they stole information related to more than 100 users with .gov email addresses, which included U.S.

Industries

Data analyticsAmerican data analytics company LexisNexis Legal & Professional has confirmed to BleepingComputer that hackers breached its servers and accessed some customer and business information.

Related Articles