LexisNexis has taken three of its Nexis Solutions products offline after detecting what it describes as “unusual activity” on servers hosted and managed by a third-party vendor.
The affected services are Nexis Diligence, Nexis Newsdesk and the Nexis Metabase API. These sit within LexisNexis’ news and business intelligence product suite.
According to The Register and Bleeping Computer, customers began experiencing problems last Wednesday. In communications sent to customers and seen by those publications (Bleeping Computer includes a screenshot), Nexis Solutions president Todd Larsen said that the company had identified unusual activity on servers “hosted and managed by a third-party vendor”.
LexisNexis disconnected from the third-party systems in order to contain the issue, taking the three applications offline in the process.
“While this decision resulted in those applications going offline, it was the right step to take to ensure the integrity of our own environment and protect our customers and data while our investigation continues,” Larsen told customers.
A spokesperson for LexisNexis told Legal IT Insider: “Last week, we identified unusual activity on servers that are hosted and managed by a third-party vendor. Our investigation is ongoing, and we are working with a preeminent cybersecurity forensic firm on review and remediation.”
They further clarified: “Nexis Solutions is not a Metabase Cloud customer, and the Nexis Metabase API product has no connection to Metabase Cloud or the reported vulnerability.”
The company is rebuilding affected systems in a new environment before returning them to service, according to reporting by BleepingComputer.
As of Monday morning (10 August), Nexis Diligence had reportedly returned, although LexisNexis was continuing to restore its full content catalogue. Customers were told that Newsdesk and the Metabase API were expected to return progressively during Monday, subject to successful testing.
Nexis Diligence is used by compliance and risk teams for due diligence, including adverse media research and screening of companies and individuals. Nexis Newsdesk is a media monitoring and analytics platform providing news and social media monitoring, while the Metabase API provides near-real-time news and social media content that customers can ingest into their own systems and applications.
They can form part of operational compliance, risk and monitoring workflows, and, in the case of an API, potentially sit upstream of customers’ own applications.
LexisNexis has not publicly identified the third-party vendor or explained exactly what the unusual activity involved.
