Cybersafetyconnections March 30,2026 vol#260 

  • From the office of Copilot, there was a data hack at  Lexis Nexis this Month of march. 
  • User profiles, enterprise customers, government users, and internal Lexis Infrastructure were affected. 
  • Multiple security failures like unpatched software, broad access of users, among other things responsible for the data breach. 
  • The cybersecurity group responsible for the cyberattack is Fulcrum Sec. 
  • Here is how Lexis Nexis mitigated loss from the cyberattack. 

🧨 What Happened 

Free theft photo 

Hackers operating under the name FulcrumSec breached LexisNexis Legal & Professional’s cloud environment, exfiltrating 2–3.9 million internal records and leaking roughly 2GB of data online. The breach was confirmed on March 4, 2026, after the attackers publicly posted stolen files and a manifesto describing the intrusion.  LawSitesstateofsurveillance.org  SecurityWeek 

👥 Who Was Impacted 

British Columbia Newspaper and popular magazine 

The breach exposed a wide range of sensitive organizational data, including: 

Impacted Groups 

  • 400,000 user profiles (names, emails, contact info, account details) 
  • 21,000+ enterprise customers, including: 
  • Law firms 
  • Government agencies 
  • Universities 
  • Corporations 
  • 100+ U.S. government users with .gov emails, including: 
  • Federal judges 
  • DOJ attorneys 
  • SEC staff 
  • Federal court law clerks 
  • Internal LexisNexis infrastructure data, including: 
  • VPC maps 
  • Cloud credentials 
  • Support tickets 
  • Customer surveys with IP addresses 

LexisNexis emphasized that no Social Security numbers, financial data, or active passwords were included.  LawSitesstateofsurveillance.org  SecurityWeek 

🛠️ Why Did It Happen? 

Handling Multiple frontiers 

The intrusion was enabled by multiple security failures: 

Root Causes 

  • Unpatched React2Shell vulnerability in a React front‑end application 
  • Overly permissive AWS IAM roles, giving attackers broad read access 
  • Hardcoded weak database password: “Lexis1234” 
  • Legacy servers containing large amounts of unmaintained data 

Attack Timeline 

  • Feb 24, 2026: Initial access via React2Shell 
  • Late Feb: Attackers move laterally and exfiltrate data 
  • Mar 3: FulcrumSec posts stolen data online 
  • Mar 4: LexisNexis publicly confirms the breach 

stateofsurveillance.org  CPO Magazine 

🕵️ Which Cybercriminal Group Was Responsible? 

Cybercrime determinant 

The attack was carried out by a threat actor calling itself FulcrumSec, a relatively unknown group prior to this incident. They published a manifesto and leaked the stolen data on cybercrime forums. 
LawSites  stateofsurveillance.org 

🛡️ How Did LexisNexis Mitigate the Loss? 

Diseaster Management 

LexisNexis took several steps to contain and respond to the breach: 

Mitigation Actions 

  • Engaged a top-tier cybersecurity forensics firm to investigate the intrusion 
  • Reported the incident to law enforcement 
  • Confirmed the breach was contained after internal testing 
  • Notified impacted customers (current and former) 
  • Asserted that: 
  • No core products or services were compromised 
  • Exposed data was “legacy, deprecated data prior to 2020” 
  • Warned customers to be vigilant against phishing attempts, as stolen metadata could be weaponized 

LawSites  SecurityWeek  CPO Magazine 

Subscribe to get the latest blog post.