Cyber Attacks Pile Up in August: LexisNexis AWS Breach Exposes 364,000 Profiles, Wesco Confirms Incident

Two of the largest security incidents disclosed this month came into sharper focus on August 13, with confirmation that the February 2026 breach of LexisNexis Legal & Professional's AWS environment exposed roughly 364,000 profiles, and supply-chain giant Wesco confirming a security incident after the ExfilSquad ransomware group claimed to have stolen 2.6 million records. The two events are part of a broader August surge that has put 2026 on track to exceed 2025's record breach count.

The LexisNexis Breach

Threat actor FulcrumSec exploited an unpatched React2Shell-class vulnerability (CVE-2025-55182) in LexisNexis L&P's AWS-hosted legacy application on or around February 24, 2026, exfiltrating 2.04 GB of structured data from Redshift and VPC tables, with vendor summaries estimating 364,000 profiles affected. The compromised data resided on servers containing legacy information from before 2020 — a fact LexisNexis cited in its March 3 confirmation to argue the impact was "limited." Security researchers told SecurityWeek that the leaked dataset nonetheless includes contact information for federal judges, DOJ attorneys and SEC staff.

Wesco Confirms Theft

Wesco disclosed the second incident on August 13, three days after the ExfilSquad group claimed to have stolen 2.6 million records containing customer and employee PII, CRM user profiles, account and contact data, credit and business identifiers, and authentication metadata. The company is a Fortune 500 supply-chain and distribution giant with more than 50,000 customers worldwide. "We are aware of the claims and are investigating the incident with external cybersecurity experts," Wesco said in a brief statement, declining to confirm the exact scope or payment of any ransom.

An August-Heavy Threat Landscape

The two incidents sit alongside a string of other breaches disclosed in August, including the Swiss government's SharePoint-linked breach affecting roughly 200 accounts and the Ryde ride-hailing breach affecting all account holders. BreachSense's running tracker now lists 460 disclosed incidents in August alone. "We are watching the August 2026 breach count climb roughly 18 percent month-over-month," Cyber Security Review reported. With Microsoft also shipping 421 CVEs in its August 11 Patch Tuesday — including an actively exploited WinSock zero-day — defenders are describing the current period as one of the most stressful of the year.