cyber.hendryadrian.com
Ransom Monitor · dailydarkweb.net

FULCRUMSEC Claims LexisNexis Breach and Extensive AWS Data Theft

· Original article ↗

Summary

FULCRUMSEC claims it exploited a vulnerable container role to access LexisNexis’s AWS infrastructure and steal data, including database records, credentials, user profiles, and internal tickets. The allegations are unconfirmed in the article.

Key points

  • FULCRUMSEC is attributed with claiming it accessed LexisNexis’s AWS infrastructure by exploiting a vulnerable container role and bypassing access controls.
  • The group alleges it took 2.04 GB of data from 536 Redshift tables and more than 430 VPC database tables.
  • The claimed data includes 53 plaintext AWS Secrets Manager secrets, including production database passwords, tokens, and API keys.
  • FULCRUMSEC alleges the data includes 3.9 million Enterprise Data Warehouse records, about 400,000 cloud user profiles, 118 government accounts, and 21,042 customer account records.
  • Other alleged data includes employee password hashes, customer passwords in support tickets, infrastructure mapping, and internal incident and engineering records.
  • The article provides the actor’s allegations but no independent confirmation of access or data theft.

Article Details

Victim
LexisNexis
Encryption Status
Not disclosed; the article does not report whether data was encrypted.
Exfiltration Status
Claimed by FULCRUMSEC; not independently confirmed.
Exfiltrated Data
FULCRUMSEC alleges that it obtained structured data from Redshift and VPC databases, plaintext AWS Secrets Manager secrets, Enterprise Data Warehouse records, cloud user profiles, government and customer account records, attorney survey responses, employee password hashes, cleartext customer passwords in support tickets, VPC infrastructure mapping, IT incident tickets, and engineering defect records.
Exfiltrated Size
FULCRUMSEC claims 2.04 GB of structured data.
Ransom Demand
Not disclosed
Leak Status
Not disclosed; the article does not report whether data was published.

Threat Actors

fulcrumsecThe article identifies FULCRUMSEC as an extortion group and reports its claim that it breached LexisNexis and exfiltrated data; the claim is not independently confirmed in the article.

Vendors

Amazon Web ServicesFULCRUMSEC claims to have breached LexisNexis by exploiting a vulnerable container role to gain broad access to the company’s AWS infrastructure and bypass access controls.

Products

AWS Secrets Managerallege exfiltrating large volumes of sensitive data—including Redshift and VPC tables, plaintext AWS Secrets Manager entries, millions of EDW records, hundreds of thousands of user profiles, government and customerRedshiftThey allege exfiltrating large volumes of sensitive data—including Redshift and VPC tables, plaintext AWS Secrets Manager entries, millions of EDW records, hundreds of thousands of user profiles, government and customer

Related Articles