---
title: "Lexitas OnDemand document exposure"
description: "Lexitas disclosed unauthenticated access to OnDemand legal documents following a server configuration error dating to around September 2019."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-23"
canonical_url: "https://www.ally.security/incidents/lexitas-ondemand-document-exposure-2019"
markdown_url: "https://www.ally.security/incidents/lexitas-ondemand-document-exposure-2019.md"
stix_url: "https://www.ally.security/incidents/lexitas-ondemand-document-exposure-2019/stix.json"
---

# Lexitas OnDemand document exposure

A misconfigured server exposed legal documents until a customer alerted Lexitas in May 2026.

Last modified Oct 23, 2026 · 1 source

## Summary

- **Environment:** OnDemand (DepositionNet) web server
- **Operational impact:** Public access restricted; no service outage established
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Lexitas](https://www.lexitaslegal.com/) said a server configuration error exposed OnDemand (DepositionNet) files without authentication from around September 2019. A customer alerted it on May 29, 2026. [1](#source-1)

## Impact

Exposed files primarily included deposition transcripts, exhibits and other legal documents. Potential personal data included names, Social Security and driver’s-license numbers, financial accounts, birth dates, medical details and insurance information. Limited logs prevented determining whether specific information was viewed, copied or downloaded. [1](#source-1)

## Timeline

### May 29, 2026 — Exposure discovered and restricted

Public access was restricted within hours of the customer report. [1](#source-1)

### October 14, 2026 — Notice dated

The [individual letter](https://oag.ca.gov/system/files/Deposition%20Solutions%20LLC%20-%20Breach%20Notification%20Letter%20%28Adult%29%20-%20Final%20Proof.pdf) describes the exposure. [1](#source-1)

### October 23, 2026 — Briefing updated

This briefing was last reviewed and updated on October 23, 2026.

## Threat Group & Attack Vector

Lexitas attributed the exposure to server configuration, reporting no evidence of malware or continuing attacker presence. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Lexitas engaged forensic specialists, tested security enhancements and offered monitoring and fraud assistance. Manual review of testimony took months; it said law enforcement did not delay notification. No known misuse was reported. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/lexitas-ondemand-document-exposure-2019/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Lexitas OnDemand consumer notification letter

official · Lexitas · Oct 14, 2026

<https://oag.ca.gov/system/files/Deposition%20Solutions%20LLC%20-%20Breach%20Notification%20Letter%20%28Adult%29%20-%20Final%20Proof.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Discovered At · 100% confidence · current**  
   Lexitas OnDemand document exposure: 2026-05-29
2. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Potential personal data included names with Social Security or driver’s-license numbers, financial-account information, dates of birth, medical information or health-insurance information.
3. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Individual notice dated
4. **Occurred At · 100% confidence · current**  
   Exposure reported and access restricted: 2026-05-29
5. **Affected Organization · 100% confidence · current**  
   Lexitas OnDemand document exposure: Deposition Solutions, LLC
6. **Occurred At · 100% confidence · current**  
   Individual notice dated: 2026-10-14
7. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Lexitas said a web-server configuration error made OnDemand (DepositionNet) files accessible over the internet without authentication from around September 2019.
8. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Files primarily comprised deposition transcripts, exhibits and other legal documents; limited server logs prevented determining whether particular information was viewed, copied or downloaded.
9. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Lexitas reported no evidence of malware or continuing attacker presence and no known fraud or misuse; it offered credit monitoring and fraud assistance.
10. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Lexitas restricted public access within hours of customer notification on May 29, 2026, engaged forensic specialists and added tested security enhancements.
11. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Exposure reported and access restricted
12. **Resulted In · 100% confidence · current**  
   Lexitas OnDemand document exposure: Manual review of information scattered through legal testimony took months; Lexitas said law enforcement did not delay notification.

</details>