LexisNexis pulled products offline over a third-party vendor incident
August 11, 2026. From issue 1 of The Compliance Brief, 2 stories for founders and executives who own security.
Issue 1 of The Compliance Brief went to subscribers on August 11, 2026. 2 of its 5 stories bear on breaches, incidents and security leadership, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for founders and executives who own security.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: BleepingComputer
LexisNexis took several services offline, including Diligence and the Metabase API, in response to unusual activity on servers hosted and managed by a third-party vendor it has not named. The company treated the shutdown as part of its incident response.
Our take, in short
Taking the service down was the right call, and it is also the version of vendor risk that most SaaS companies have never modelled. Your subprocessor list probably names the screening or data provider, and almost certainly says nothing about who runs their infrastructure, so an outage two layers out becomes your degraded onboarding flow and your customer notification.
Read the full take on traztech.ca
Gunra ransomware is getting in through firewalls, per a joint advisory
Source: The Hacker News
US and South Korean agencies issued a joint advisory on Gunra, a ransomware-as-a-service operation that has been breaching organizations by exploiting vulnerabilities in Fortinet and Schneider Electric products. Named targets span critical infrastructure, healthcare, financial services and government.
Our take, in short
Nothing in this advisory is novel, which is the uncomfortable part. Internet-facing appliances remain the cheapest way in, and most companies I test have a documented patch SLA for servers and an informal one for the firewall and the VPN concentrator.
Read the full take on traztech.ca
Related on HireACISO
- Bringing in a vCISO after a breach
- Security maturity assessment, seven domains
- Vendor risk management, done proportionately
- First two weeks after a security incident
Also in issue 1
Outside breaches, incidents and security leadership, but in the same email:
- New York fined a money transmitter for a weak program, not a breach
- The Snowflake extortion case ends with a guilty plea in Kitchener
- Hidden prompt injection is showing up in "Ask AI" buttons on marketing pages
All issues on HireACISO Newer: issue 3
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.