LexisNexis Breach Exposes 364,000 via GitHub; Researcher Finds 184 Million Apple, Google, Microsoft, Facebook Passwords Leaked

LexisNexis Risk Solutions, a major data broker, has disclosed a data breach affecting more than 364,000 individuals. The breach occurred on December 25, 2024, when an unauthorized party accessed data through a third-party software development platform, including the company's GitHub account. The incident was discovered on April 1, 2025, and reported to the Maine attorney general. The compromised data includes names, dates of birth, phone numbers, postal and email addresses, Social Security numbers, and driver’s license numbers. LexisNexis confirmed that no financial or credit card information was affected, there was no impact on its own systems, and there is no evidence the data has been misused. LexisNexis has notified law enforcement and regulators, and is offering two years of free identity protection and credit monitoring to affected individuals. External cybersecurity experts have been engaged to assist in the investigation. Separately, cybersecurity researcher Jeremiah Fowler discovered an unprotected online database containing 184,162,718 unique usernames and passwords in plain text, including credentials for accounts with Apple, Google, Microsoft, Facebook, and other major platforms. The database also included sensitive information for banking, healthcare, and government services, as well as government accounts in at least 29 countries. Analysis suggests the data may have been collected by infostealer malware, such as Lumma Stealer. The database was hosted by World Host Group, which has since removed public access, but the owner has not been identified.