LexisNexis Legal & Professional: AWS environment breached through an unpatched React2Shell front end

What happened

• LexisNexis confirmed “an unauthorized party accessed a limited number of servers” holding what it called legacy, deprecated data from before 2020, and said no SSNs, driver’s licence numbers, financial data, active passwords, search queries or client matter data were involved. The attacker (FulcrumSec) claims 2.04 GB of structured data: 536 Redshift tables, 430+ VPC database tables, 53 plaintext AWS Secrets Manager secrets, 3.9 million records, 21,042 customer accounts and about 400,000 cloud user profiles. These counts are not confirmed by LexisNexis.
• Initial access as claimed by FulcrumSec: the React2Shell RCE (CVE-2025-55182) in an unpatched React front-end app running on ECS, then a single ECS task role with read access to every secret in the account, including the production Redshift master credential. LexisNexis has not publicly confirmed the vector.
• FulcrumSec claimed it; intrusion dated 24 Feb 2026 by the attacker.
• LexisNexis notified law enforcement, engaged an external firm and informed current and former customers.

Sources

• https://www.bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-stolen-files/
• https://scworld.com/brief/lexisnexis-legal-professional-confirms-data-breach-after-react2shell-exploit

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.