Lexitas, a litigation support provider, has notified people that a web server configuration error left deposition transcripts and related legal files accessible online without a login. The company’s notice letter is dated October 14, 2026.
Deposition Solutions, LLC (d/b/a Lexitas)’s Data Breach Investigation
Deposition Solutions, LLC, which does business as Lexitas, provides litigation support services, including court reporting and deposition transcript services. Law firms, insurers, corporations and other parties use providers like this to record testimony, produce transcripts and store exhibits connected to lawsuits. That work means the company holds files that can contain a great deal of sensitive personal detail about the people who testify or are discussed in a case.
According to the notice letter filed with the California Attorney General, a customer told Lexitas on May 29, 2026 that a web server configuration error had made certain files in its OnDemand application, also called DepositionNet, reachable over the internet without authentication. The company’s investigation concluded that the misconfiguration occurred in or around September 2019 and was not detected at the time. In plain terms, the files appear to have been open to anyone who found them for a period the letter measures in years, not days.
Lexitas says it restricted access to the affected server within hours of learning of the problem and then began an investigation. The files at issue consisted primarily of deposition transcripts, exhibits and other legal documents. The company explains that personal information in those documents is scattered through written testimony rather than stored in an organized, searchable database, so working out who was affected required extensive manual review that took several months. The letter states that the notice was not delayed because of a law enforcement investigation.
The company also says the available server logs were limited. Because of that, Lexitas could not determine whether any particular person’s information was actually viewed, copied or downloaded. It reports that it is not aware of any fraud or misuse tied to the incident. That statement is worth reading carefully: it is not a finding that nobody accessed the files, only that the company has not identified misuse and lacks the logs to say who looked at what. Lexitas also engaged a cybersecurity firm for a forensic investigation, which found no evidence of malware or an ongoing threat actor presence in its environment when the work was done, and the company says it added security enhancements that were verified through testing.
The notice letter states that approximately 14,361 individuals nationwide were affected. That figure appears in the portion of the letter addressed to Rhode Island residents, and it is the only total the filing provides. Multi-state breaches are often reported to regulators in several jurisdictions, and each filing may describe the number of residents in that particular state or the overall total, so figures you see elsewhere may differ depending on which filing they come from. This page uses the nationwide figure stated in the company’s own notice.
Litigation records are a different kind of data exposure than a typical retail or payment card incident. A deposition transcript can contain sworn answers about a person’s finances, health history, employment, family and identity, often with identifiers such as dates of birth or account numbers mentioned in passing. Documents of that kind can stay sensitive for many years, and a person who gave testimony long ago may have no idea a copy still sat on a vendor’s server. The sector is also a common focus for fraudsters and data thieves precisely because legal files concentrate so much personal information in one place. That is general industry context, not a statement about what any individual did with these files.
Lexitas is offering affected people single bureau credit monitoring, a credit report and a credit score, along with fraud assistance, through Cyberscout, a TransUnion company. The letter says people must enroll within 90 days of the letter date and that a unique enrollment code is included in each person’s own notice. A help line and an email contact are listed in the letter for questions. If you received a notice, keep it, because it explains the services available to you and the deadline that applies.
Companies that collect and store people’s records on behalf of their clients are expected to secure them with reasonable safeguards and to notice and fix exposures promptly. A misconfiguration that persisted from about September 2019 until it was reported by a customer in May 2026 raises obvious questions about how the system was monitored. Those are the kinds of questions attorneys can raise for people whose information was involved, and this page will be updated if Lexitas or a regulator publishes more detail.
When Did This Breach Occur?
According to the notice, the server configuration error occurred in or around September 2019 and went undetected. Lexitas learned of the problem on May 29, 2026, when a customer reported it, and it restricted access to the server within hours.
The notification letter itself is dated October 14, 2026. The gap between the 2019 misconfiguration and the 2026 letter reflects both the long period before detection and the months of manual document review the company says it needed to identify affected people.
What Information Was Breached?
The letter says the affected files may have contained a person’s name combined with a Social Security number, driver’s license number, financial account information, date of birth, medical information or health insurance information. Not every person’s record necessarily included every item, and the company says what was involved varies by individual.
Because the files were mainly deposition transcripts, exhibits and legal documents, the information may have come from testimony or from documents attached as exhibits in a case. Lexitas states it could not confirm whether any specific person’s information was viewed, copied or downloaded.
What You Can Do
If you received a notice related to Deposition Solutions, LLC (d/b/a Lexitas) or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the free credit monitoring through Cyberscout using the code in your letter before the deadline stated in the notice, and consider a credit freeze if your Social Security number or financial details were involved.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Deposition Solutions, LLC (d/b/a Lexitas)
If you received a notice from Lexitas, or you gave testimony or were named in a legal matter handled by a litigation support provider, you may have legal options. Companies are expected to safeguard the sensitive information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
