Most law firms think about their own network when they think about a data breach. The Lexitas notice filed with the California Attorney General on Oct. 22, 2026 is a reminder that some of a firm's most sensitive files live somewhere else: with the court reporting and litigation support vendors that handle depositions and exhibits.
Deposition Solutions, LLC, doing business as Lexitas, provides litigation support services, including court reporting and deposition transcript services. In notice letters dated Oct. 14, 2026, it says a web server configuration error left certain files in its OnDemand (DepositionNet) application "accessible over the internet without authentication," and that the error dates to "in or around September 2019." The notice says approximately 14,361 individuals nationwide were affected.
What Lexitas has said, and what it hasn't
Confirmed in the notice:
- How it was found: On May 29, 2026, Lexitas "learned from a customer" about the configuration error. It says it restricted access to the affected server "within hours."
- What was exposed: The affected files "consisted primarily of deposition transcripts, exhibits, and other legal documents."
- What personal data may be in them: Depending on the person, a name combined with a Social Security number, driver's license number, financial account information, date of birth, medical information, or health insurance information.
- Why notice took months: Personal information was "scattered throughout written testimony rather than organized in a searchable database," so identifying people required "extensive manual review."
- What the investigation found: A cybersecurity firm determined the incident was caused by the configuration error and found "no evidence of malware or ongoing threat actor presence." Lexitas says it is "not aware of any fraud or misuse" of the information and is offering credit monitoring and fraud help through Cyberscout.
Not known: Because "the available server logs were limited," Lexitas says it "could not determine whether your specific information was viewed, copied, or downloaded." The notice doesn't name the law firms or cases whose files were involved. This was not described as ransomware, a hack, or an outage, so don't assume any of those. What it does show is that files can sit open on the internet for years without anyone noticing.
Why it matters to law firms and professional offices
Deposition transcripts and exhibits are full of the details clients trust you to protect: medical records entered as exhibits, financial statements, Social Security numbers read into the record. Once those files leave your document system for a court reporter, a records retrieval service, an e-discovery platform or an expert, your security only goes as far as theirs. And as the Lexitas notice shows, the person who spots the problem may be a customer, not the vendor.
The same lesson applies to accounting firms, insurance agencies, staffing firms and any office that hands client files to an outside portal. You can't fix a vendor's web server, but you can control what you send, how long it stays there, and who can reach it.
Clear takeaway
If you use Lexitas, ask your account contact in writing whether any of your firm's matters were in the affected files, and what notice your clients will get. Then treat every litigation-support and document vendor the same way: know what they hold, require logins on every shared link, and have them delete files when the matter closes.
Actions to take this week
- Ask Lexitas directly. If your firm has used Lexitas or DepositionNet, ask in writing whether your matters were involved, which clients or witnesses may receive letters, and what Lexitas found. Note the answers in the matter file. Lexitas lists a help line and
lexitashelp@transunion.comin its notice for people who received letters. - List your document vendors. Court reporters, e-discovery and hosting platforms, records retrieval, copy and scanning services, and expert witnesses. For each, write down what kinds of client data they hold and how you share it with them.
- No anonymous links. Require that transcripts, exhibits and productions be shared only through accounts with a username, password and MFA, never through open download links. Ask each vendor whether any of your files can be reached without logging in.
- Set a deletion date. Ask vendors how long they keep your files after a matter closes, and put a retention and deletion clause in the engagement. Files that are gone can't be exposed.
- Ask about logs. Lexitas couldn't tell who viewed the files because its logs were limited. Ask your vendors how long they keep access logs and whether they would be able to tell you who downloaded a file.
- Know your own duties. Talk with your ethics counsel or malpractice carrier about whether you need to tell clients when a vendor reports an exposure, and update your incident response plan to cover vendor-side incidents.
Brotherly Technology helps law firms, accounting practices and professional offices across Rome, Northwest Georgia, Atlanta, Chattanooga and the Southeast review vendor access, lock down client file sharing, and build incident plans that include their vendors. If you'd like help listing what your vendors hold and closing the open doors, give us a call.
Sources:
- California Attorney General: Submitted Breach Notification Sample, Deposition Solutions, LLC (d/b/a Lexitas) (posted Oct. 22, 2026; breach date listed as Sept. 1, 2019).
- Lexitas sample notice letter filed with the California Attorney General (dated Oct. 14, 2026). Source for all quotes, data types, and the 14,361 nationwide figure.
- BreachRecord: Deposition Solutions, LLC (d/b/a Lexitas) Breach (Oct 2026), summarizing the same filing.