A supplier outage is the risk I find smaller firms underprice most. Between Wednesday 5 August 2026 and the following Monday, LexisNexis took three of its Nexis products offline after identifying what it called unusual activity on servers hosted and managed by a third-party vendor. One of the three, Nexis Diligence, is the tool risk and compliance teams reach for when they screen a client or a counterparty against adverse media. For the firms that rely on it, a step in onboarding stopped working for the better part of a week.
The company disconnected from the third-party systems rather than wait for its investigation to finish. Todd Larsen, president of Nexis Solutions, told customers that a cybersecurity forensic firm had been engaged and that the affected systems would be rebuilt in a new environment before they returned to service. Diligence came back over the weekend, with Newsdesk and the Metabase API restored after it. LexisNexis has not said whether any data was reached. The outage sat in neither your firm nor your supplier, and it still stopped your work.
The outage sat in neither your firm nor your supplier, and it still stopped your work.
The link you never signed
Your engagement is with the supplier whose invoice you pay. That supplier buys hosting, screening data, model capacity and search from other companies, and your contract rarely names them. When you ran your due diligence you asked about encryption, data location and accreditation, and every answer described the company selling to you. Nothing in the file recorded who that company depends on for the service to run at all. Ask your main suppliers for their subprocessor list in writing, and ask to be told when it changes. A supplier who cannot produce one has not thought about this either.
The pressure the gap creates
A tool that goes dark for four working days does not stop the work arriving. Completions keep their dates and clients still want their matter opened. The risk in a small practice is not the outage but what somebody does at four o'clock on the Friday, when the screening will not run and the file has to move. The regulator spent the same fortnight saying the opposite, in a sectoral risk assessment that treats remote onboarding and AI-enabled impersonation as a live threat. A week without your checks is the week that warning matters most.
What to have ready
Write down, for each tool that touches a regulated step, what your firm does while it is unavailable. For screening that means naming the second source you will use, who pays for it and who authorises the switch. For research it means checking authority against a report you hold rather than a service you rent. Keep the answers short enough for a supervisor to read in a minute, because a continuity plan nobody has read is not one.
Then take the point to your renewals. Ask what the supplier owes you when the service is unavailable, whether the credit is worth claiming, and how fast you are told that something has gone wrong at a company you have never heard of. We looked at the same problem from the other end in When your AI disappears for nineteen days. The dependency is structural, so the lesson repeats. You buy an outcome from a chain you cannot see, and the part of it you control is what your firm does on the day it breaks.
The outage and the statement from Nexis Solutions are reported by Legal IT Insider in LexisNexis takes three products offline after unusual activity on third-party servers, published on 11 August 2026. LexisNexis has issued no public statement of its own to link.
If you cannot say today which outside companies your practice depends on to open a file, that list is the first thing we build with the firms we work with: start with a conversation.