American analytics giant LexisNexis confirmed that it recently suffered a data breach, but downplayed its significance by stating that the hackers only stole outdated and irrelevant data. Hackers, on the other hand, claim the opposite.
beepcomputer
The group allegedly broke into a React container with access to hundreds of Redshift tables, VPC database tables, dozens of AWS Secrets Manager secrets (in plain text) and employee password hashes, millions of database records, thousands of customer accounts, and more. From there, they were able to extract information related to more than 100 users with .gov email addresses, such as federal judges, US Department of Justice attorneys, SEC staff, and others. They also accessed roughly 400,000 cloud user profiles with real names, email addresses, phone numbers, and job functions.
Legacy and obsolete data
“These servers contained mostly legacy and obsolete data from before 2020, including information such as customer names, user IDs, business contact information, products used, customer surveys with respondents’ IP addresses, and support tickets,” a company spokesperson said.
“The affected information did not contain Social Security numbers, driver’s license numbers, or any other sensitive personally identifiable information; credit card, bank account, or other financial information; active passwords; or customer search queries, customer or matter information, or customer contracts.”
FulcrumSec said it attempted to contact LexisNexis (probably demanding a ransom payment in exchange for deleting the data), but the company “decided not to work with us,” the criminals said.
LexisNexis now believes the attack is contained.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
