People search LexisNexis data breach timeline because the brand sits on billions of accounts, credentials, and cloud workloads. BreachHistory indexes 9 LexisNexis-linked incidents, with headline counts up to 3.9M+ in catalog rows. This page maps every attested event through 2026 with internal links to canonical records.
Why LexisNexis breach history matters
LexisNexis operates in Finance (United States). Across indexed rows, recurring themes include cloud and database misconfiguration, zero-day exploitation and malware. Understanding the chronological pattern helps security teams, customers, and regulators separate confirmed disclosures from forum marketing.
Full timeline through 2026
2026 — 3.9M records (FulcrumSec, React2Shell / Reach2Shell)
Cataloged incident. LexisNexis Legal & Professional (separate from LexisNexis Risk Solutions) confirmed a data breach in early March 2026. Some headlines conflate this with the Risk Solutions cloud incident (~364K profiles in public filings); the ~3.9M figure applies here (Legal & Professional), not Risk. Threat actor FulcrumSec exploited an unpatched React2Shell-class vulnerability (also referred to as Reach2Shell in some analyses) in a React frontend application. Attackers accessed an AWS-hosted environment with broad read permissio Exposed categories include Names, business contact info, user IDs, support/ticket context, IP-related data; no highly sensitive PII confirmed in LexisNexis public statements. BreachHistory cites approximately 3.9M+ affected records in this row. See the lexisnexis-legal 2026 record and canonical BreachHistory entry.
2026 — FulcrumSec AWS breach (~364K profiles; React2Shell / Reach2Shell)
Cataloged incident. LexisNexis Risk Solutions confirmed a cloud data breach disclosed in March 2026 (distinct from the LexisNexis Legal & Professional ~3.9M-record incident in the same timeframe—some media incorrectly attributes ~3.9M records to Risk; that figure aligns with Legal & Professional, breach id lexisnexis-legal2026). Threat actor FulcrumSec exploited an unpatched React2Shell-class issue (Reach2Shell naming in some reports) in AWS-facing infrastructure. Press and vendor summaries cited roughly 364,000 impacted profiles, wit Exposed categories include Names, business contact info, user IDs, support tickets, IP-related data; highly sensitive PII not confirmed in firm statements. BreachHistory cites approximately 364K+ affected records in this row. See the lexisnexis 2026 record and canonical BreachHistory entry.
2014 — — LexisNexis: Hackers stole millions of social security numbers -…
Cataloged incident. Hackers stole millions of social security numbers - including Michelle Obama's - from 3 large US data brokers BreachHistory cites approximately 1M+ affected records in this row. See the lexisnexis2014 and canonical BreachHistory entry.
2013 — — LexisNexis: LexisNexis informed Sprechman & Associates that the…
Unverified claim — treat actor counts cautiously. LexisNexis informed Sprechman & Associates that the unusual, excessive activity of an associate caused them to eliminate that associate's access to LexisNexis' database. The associate was later found to have misused Social Security numbers in order to file over 11 million dollars in fraudulent tax refund claims. The dishonest associate was not immediately fired from Sprechman & Associates and was terminated in July 2012 when law enforcement used a warrant to search his home and office computers Exposed categories include Personal information. BreachHistory cites approximately 20K+ affected records in this row. See the lexisnexis2013 and canonical BreachHistory entry.
2011 — — LexisNexis: Sensitive information was exposed by a breach at…
Cataloged incident. Sensitive information was exposed by a breach at Onyx Collections. Someone connected to Onyx Collections was misusing Onyx Collections' search account to access the personal information of people. LexisNexis discovered the problem after conducting an audit of Onyx Collections. From September 10, 2009 through March 2, 2011, Onyx Collections had access to names, addresses, dates of birth, driver's license numbers and Social Security numbers of at least 74 people from New Hampshire. The total nu Exposed categories include Personal information. BreachHistory cites approximately 74 affected records in this row. See the lexisnexis2011 and canonical BreachHistory entry.
2009 — — LexisNexis: Companies Lexis Nexis and Investigative…
Cataloged incident. Companies Lexis Nexis and Investigative Professionals have notified up to 40,000 individuals whose sensitive and personally identifiable information may have been viewed by individuals who did not have legitimate access. The data breach is linked to a Nigerian scam artist who used the information to incur fraudulent charges on victims' credit cards. Of the 40,000 individuals whose information was accessed, up to 300 were compromis Exposed categories include Personal information. BreachHistory cites approximately 40K+ affected records in this row. See the lexisnexis2009 and canonical BreachHistory entry.
2007 — — LexisNexis: LexisNexis sent out notification letters of two…
Cataloged incident. LexisNexis sent out notification letters of two separate incidents. A law enforcement customer noticed that an account was used in an unauthorized way. Searches that revealed names, Social Security numbers and driver's license numbers may have been performed by an unauthorized user or without proper reason. The second incident involves a government agency employee who may have used his account in an unauthorized manner to view names, Social Security numbers, addresses and driver's license num Exposed categories include Personal information. BreachHistory cites approximately 220 affected records in this row. See the lexisnexis2007 and canonical BreachHistory entry.
2006 — — LexisNexis: A package containing an employee's laptop computer…
Cataloged incident. A package containing an employee's laptop computer was lost by an overnight courier service during shipping. The laptop may have included the names, Social Security numbers, driver's license numbers, dates of birth and addresses of certain individuals. At least 53 residents of Maine and 396 residents of New York were affected, but the total number of affected individuals nationwide was not reported. Exposed categories include Personal information. BreachHistory cites approximately 449 affected records in this row. See the lexisnexis2006 and canonical BreachHistory entry.
2005 — — LexisNexis: Unauthorized individuals used IDs and passwords of…
Cataloged incident. Unauthorized individuals used IDs and passwords of legitimate customers to obtain consumers' Social Security numbers, driver's license numbers, and names and addresses. Most of the breaches were at the company's subsidiary Seisint Inc., based in Florida. UPDATE (4/12/05) An internal investigation at LexisNexis has uncovered evidence that an additional 280,000 records may have been involved in this breach, increasing the total from 30,000 to 310,000.UPDATE (06/30/06): Fiv Exposed categories include Personal information. BreachHistory cites approximately 310K+ affected records in this row. See the lexisnexis2005 and canonical BreachHistory entry.
Patterns and analysis
- Cloud and database misconfiguration — appears across multiple LexisNexis catalog entries; prioritize controls that address this class of failure.
- Zero-day exploitation and malware — appears across multiple LexisNexis catalog entries; prioritize controls that address this class of failure.
- Record-count hygiene — BreachHistory indexes actor-cited figures separately from company-confirmed totals; read each row's technicalWriteup before treating counts as fact.
- 2026 monitoring — New disclosures roll into this timeline as they are verified or labeled unverified per catalog policy.
What to do if you may be affected
- Step 1: Enable phishing-resistant MFA on every account tied to this brand.
- Step 2: Use unique passwords and a password manager—breach rows often involve credential reuse.
- Step 3: Monitor official company breach notices and regulator filings, not dark-web downloads.
- Step 4: Bookmark the LexisNexis company page for new 2026+ disclosures.
Canonical BreachHistory hub
Explore every indexed row: breachhistory.com/lexisnexis · Latest: lexisnexis-legal2026.
Sources: BreachHistory catalog (9 rows for LexisNexis), company and regulator disclosures cited in individual breach records.