LexisNexis Confirms AWS Cloud Breach After Hackers Exploit Unpatched React Vulnerability and Leak 2 GB of Data Including Federal Judge Records
Threat actor FulcrumSec exploited the React2Shell vulnerability in LexisNexis AWS infrastructure, exfiltrating 3.9 million records and claiming access to 400,000 user profiles including U.S. government personnel.
Overview
LexisNexis Legal & Professional, the legal research and data analytics giant owned by RELX, confirmed on March 4 that a threat actor breached its Amazon Web Services infrastructure and exfiltrated approximately 2 GB of company data. The attacker, operating under the name FulcrumSec, exploited an unpatched React2Shell vulnerability in a React frontend container to gain initial access on or around February 24, then pivoted through overprivileged service accounts to reach databases, secrets vaults, and internal systems across the company’s virtual private cloud.
The breach raises pointed questions about credential hygiene and least-privilege access in enterprise cloud environments, particularly given the sensitivity of LexisNexis’s client base, which spans law firms, government agencies, insurance companies, and universities.
What We Know
According to The Register, FulcrumSec gained entry by exploiting a React2Shell vulnerability in an unpatched React container running on a LexisNexis AWS instance. The vulnerability, which had reportedly been left unaddressed for months, allowed the attacker to escalate from a web frontend into the broader cloud environment.
The compromised workload possessed excessive IAM permissions, as detailed by Security Boulevard, enabling access to 53 plaintext entries in AWS Secrets Manager. Those credentials included GitHub tokens, Azure DevOps credentials, Databricks tokens, Salesforce client secrets, and analytics platform keys for Looker and Tableau. The analysis also noted that the password “Lexis1234” was reused across multiple internal systems.
FulcrumSec claims to have exfiltrated 536 Redshift tables, more than 430 VPC database tables, 3.9 million database records, 21,042 customer accounts, and 5,582 attorney survey respondents’ records. The group posted a manifesto and a link to the leaked data on March 3, one day before LexisNexis publicly confirmed the incident.
Perhaps most concerning, FulcrumSec claimed access to approximately 400,000 cloud user profiles containing real names, emails, phone numbers, and job functions, according to Cybernews. Among those profiles, the attacker identified 118 users with .gov email addresses belonging to U.S. federal judges, law clerks, Department of Justice attorneys, and SEC staff.
As reported by LawNext, FulcrumSec also noted that ransom negotiations with LexisNexis were rejected, and characterized the breach as unrelated to a separate 2025 GitHub incident that had affected 364,000 individuals.
LexisNexis Response
LexisNexis stated that the accessed servers contained “mostly legacy, deprecated data from prior to 2020,” including customer names, user IDs, business contact information, product subscription details, customer surveys with respondent IP addresses, and support tickets. The company explicitly denied that Social Security numbers, financial data, active passwords, or customer search queries were included in the compromised material.
“We believe the matter is contained. We have no evidence of compromise of or impact to our products and services,” the company said, according to LawNext. LexisNexis engaged third-party digital forensics experts and reported the incident to law enforcement. The company also began notifying affected current and former customers.
What We Don’t Know
Several critical questions remain unanswered. LexisNexis has not disclosed how long the React2Shell vulnerability was known internally before exploitation, nor has it explained why the compromised service account held permissions broad enough to access secrets across the entire VPC. The company has not confirmed or denied FulcrumSec’s claim of 400,000 compromised user profiles, instead characterizing the breach as limited to “a limited number of servers.”
The identity and motivation of FulcrumSec remain unclear. The group has not been linked to any known nation-state operation or established cybercriminal syndicate. Whether the 53 exposed AWS secrets were rotated before the breach was disclosed, and whether any downstream systems accessed via those credentials were also compromised, has not been addressed publicly.
Analysis
The LexisNexis breach is a textbook illustration of how a single overprivileged cloud workload can cascade into enterprise-wide exposure. The combination of an unpatched web-facing vulnerability, plaintext secrets in a centralized vault, password reuse, and broad IAM permissions gave FulcrumSec a path from a React container to the company’s most sensitive data stores.
For an organization that serves as a critical information backbone for the U.S. legal system, the presence of federal judge and DOJ attorney records in the compromised data heightens the incident’s significance beyond a routine corporate breach. Even if the data is legacy, as LexisNexis contends, the exposure of government personnel information to an unknown threat actor introduces national security considerations.
The breach also underscores a recurring pattern in cloud security incidents: organizations that migrate to cloud infrastructure often carry forward legacy applications and permissive access configurations that were tolerable in on-premises environments but become exploitable attack surfaces in cloud deployments. The React2Shell vulnerability, reportedly left unpatched for months, suggests that vulnerability management processes did not adequately cover containerized frontend components within the AWS environment.