LexisNexis
bd_32c0f32e461ed402 · schema v1 · pii pii-v1
Full breach record for LexisNexis →6 incidents on filePress / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
LexisNexis shuts down services after suspicious activity on servers. LexisNexis: LexisNexis had to take its Diligence, Metabase API, and Newsdesk services offline following unusual activity detected on servers managed by a third-party provider. The company is investigating the incident with the assistance of a forensic cybersecurity firm and is rebuilding the affected systems in a new environment before bringing them back online. LexisNexis also clarified that its services are not related to the Metabase cloud service or the recently mentioned SQL injection vulnerability. Linked ransomware group: fulcrumsec.
P pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Aug 9, 2026
Press report
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Attack → press
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
If an SEC 8-K, state-AG notice or victim statement lands, DisclosureLens merges it into an incident and links it here.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
fulcrumsec
According to ransomware.live, FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption, with known victims including Australian fintech youX and LexisNexis.