Lexitas Data Breach: 7-Year Long Undetected Error May Have Leaked Information

Lexitas, formally registered as Deposition Solutions LLC, disclosed a data breach that affected approximately 14,361 individuals in the United States.

The breach was reported to the California Attorney General and to the Vermont Attorney General on Oct. 22, 2026. Lexitas began notifying affected consumers by written notice on Oct. 14, 2026.

The breach was caused by a web server configuration error in Lexitas' OnDemand (DepositionNet) application. The error caused certain files stored on the server to become accessible over the internet without requiring authentication.

The configuration error occurred in or around September 2019 and went undetected for nearly seven years.

On May 29, 2026, a customer alerted Lexitas that files on its web server were publicly accessible. The company restricted access to the affected server within hours and launched an investigation to determine what information may have been affected.

The affected files consisted primarily of deposition transcripts, exhibits and other legal documents.

The types of personally identifiable information and protected health information exposed included names, Social Security numbers, driver's license numbers, government identification numbers, financial account information, credit and debit account information, dates of birth, login credentials, medical information, health insurance information, health records, biometric information and genetic information.

Lexitas' response to the breach

Lexitas is offering affected individuals free single-bureau credit monitoring, credit report and credit score services through Cyberscout, a TransUnion company. To enroll, affected individuals can visit the Cyberscout activation page and enter the unique code included in their notification letter.

Enrollment must be completed within 90 days of the date of the letter.

Lexitas has set up a dedicated help line at 1-833-544-7602, available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding holidays. Representatives will be available for 90 days from the date of the notification letter.

Affected individuals can also reach the company by email at lexitashelp@transunion.com or by writing to Deposition Solutions LLC (d/b/a Lexitas), Attn: Data Security Incident Response, 4424 W Sam Houston Parkway N, Suite 420, Houston, TX 77041.