GetSOC2

LexisNexis pulled products offline over a third-party vendor incident

August 11, 2026. From issue 1 of The Compliance Brief, one story for companies buying a SOC 2 audit.

Last reviewed 2026-08-11Written by Jacob Masse, TrazTech Inc.

Issue 1 of The Compliance Brief went to subscribers on August 11, 2026. One of its 5 stories bears on SOC 2 audits, auditors and vendor reviews, and they are below in short form. The full issue, with every take in full, is on traztech.ca.

Source: BleepingComputer

LexisNexis took several services offline, including Diligence and the Metabase API, in response to unusual activity on servers hosted and managed by a third-party vendor it has not named. The company treated the shutdown as part of its incident response.

Our take, in short

Taking the service down was the right call, and it is also the version of vendor risk that most SaaS companies have never modelled. Your subprocessor list probably names the screening or data provider, and almost certainly says nothing about who runs their infrastructure, so an outage two layers out becomes your degraded onboarding flow and your customer notification.

Read the full take on traztech.ca

Also in issue 1

Outside SOC 2 audits, auditors and vendor reviews, but in the same email:

All issues on GetSOC2 Newer: issue 2