LexisNexis Legal & Professional confirms data breach after React2Shell exploit

Per Bleeping Computer, data analytics company LexisNexis Legal & Professional has confirmed a data breach impacting customer and business information following a cyberattack.

The breach occurred on February 24 when threat actor FulcrumSec exploited the React2Shell vulnerability in an unpatched React frontend application to gain access to the company's AWS infrastructure. LexisNexis stated that the accessed data was largely legacy information predating 2020, including customer names, user IDs, business contact details, and support tickets. The company emphasized that sensitive personal information like Social Security numbers, financial data, active passwords, or client-specific legal information was not compromised.

FulcrumSec claims to have exfiltrated 2.04 GB of data, including details on over 100 users with .gov email addresses, such as U.S. government employees, federal judges, and Department of Justice attorneys. The hackers also reported accessing numerous database tables, AWS secrets, and customer account information.

Source: Bleeping Computer