LexisNexis Data Breach — Threat Actor Allegedly Claims 2.04 GB Stolen

A threat actor operating under the alias FulcrumSec has publicly claimed responsibility for a fresh breach of LexisNexis Legal & Professional, the legal information division of RELX Group, alleging the exfiltration of 2.04 GB of structured data from the company’s AWS cloud infrastructure.

According to FulcrumSec’s post published on March 3, 2026, initial access was gained on February 24 by exploiting the React2Shell vulnerability in an unpatched React frontend application, a flaw the company had reportedly left unaddressed for months.

The threat actor leveraged the compromised LawfirmsStoreECSTaskRole ECS task container, which had been granted read access to the production Redshift data warehouse, 17 VPC databases, AWS Secrets Manager, and the Qualtrics survey platform.

Notably, the actor criticized the company’s security posture, pointing out that the RDS master password was set to “Lexis1234”, and that a single task role held read access to every secret in the AWS account, including production database master credentials.

Data Asset	Alleged Volume
Redshift Tables	536
VPC Database Tables	430+
AWS Secrets Manager Secrets (Plaintext)	53
Total Database Records	3.9 Million
Cloud User Profiles	~400,000
Enterprise Customer Accounts	21,042
Employee Password Hashes	45
.gov Email Users Exposed	118

FulcrumSec alleges that among the 400,000 cloud user profiles containing real names, emails, phone numbers, and job functions, 118 accounts held .gov email addresses belonging to federal judges, federal court law clerks, U.S. Department of Justice attorneys, and U.S. SEC staff.

The actor also claims to have obtained a complete VPC infrastructure map and the full AWS Secrets Manager dump with 53 plaintext secrets.

FulcrumSec explicitly noted this is not related to the December 2024 GitHub breach, in which an unauthorized party stole personal data, including Social Security numbers of over 364,000 individuals, via LexisNexis’s third-party software development platform.

The recurrence raises significant concerns about systemic security gaps within one of the world’s most sensitive legal data repositories.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.