LexisNexis Takes Three Services Offline After Suspicious Activity on Vendor Servers
Summary
LexisNexis took Diligence, Metabase API, and Newsdesk offline after detecting suspicious activity on a third-party vendor’s servers. The company is investigating and rebuilding affected systems; it has not reported data theft in this incident.
Key points
- LexisNexis disconnected from the vendor-managed servers to contain the issue.
- The affected services are Diligence, Metabase API, and Newsdesk.
- The company is investigating with a cybersecurity forensic firm and rebuilding affected systems in a new environment before restoring service.
- LexisNexis said its Metabase API is not connected to Metabase Cloud or the separately reported SQL injection vulnerability.
Article Details
- Victim Organization
- LexisNexis
- Incident Type
- Suspicious activity on servers hosted and managed by an unnamed third-party vendor; LexisNexis disconnected from those systems and took services offline as a precaution.
- Operational Impact
- Diligence, Metabase API, and Newsdesk services were taken offline. LexisNexis said it was investigating and rebuilding affected systems in a new environment.
- Claim Status
- confirmed
People
Threat Actors
Products
AWSEarlier this year in March, LexisNexis was targeted by the threat actor ‘FulcrumSec’ after exploiting the ‘React2Shell’ flaw in the company's AWS infrastructure to steal and later leak private files.DiligenceLexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers hosted and managed by an unnamed third-party vendor.Metabase APILexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers hosted and managed by an unnamed third-party vendor.NewsdeskLexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers hosted and managed by an unnamed third-party vendor.