Why you got a breach letter from a company you never dealt with

The short answer

This guide reads three breach notices side by side. The question put to each letter is the same: who held the data, and what reason does the letter give for holding it? The sections below take the senders one at a time. They then turn to what the letters offer and what they leave open.

Reading the letters this way shows that each one carries its explanation in a single sentence or two. The rest of each letter is the standard material on credit reports, fraud alerts and state contacts. The explanation of the sender's role is the part that answers the question in the working title.

Mercadien: an accounting firm serving financial institutions

The Mercadien notice opens by naming the firm and describing its work. The notice states that Mercadien provides accounting and advisory services to financial institutions and obtained the reader's information while providing those services.

The notice then ties the data to a specific engagement. It says Mercadien determined that the files involved included information it received from another party, shown in the filed copy as the placeholder [Extra1], related to an advisory services engagement. The filed copy therefore does not name the source in the text available to us.

The letter also addresses a point a reader may wonder about, which is whether their own bank was breached. The notice says the incident occurred on Mercadien's network and did not affect the systems and files of the financial institution.

The reader's relationship, in this account, ran through the financial institution. The letter does not describe any direct dealing between the reader and the accounting firm.

ETS and the California Department of Education: a contractor acting at a state agency's direction

The second notice has a different structure. It is issued by one organization on behalf of another. The notice says Educational Testing Service (ETS) is notifying California students and families at the direction of the California Department of Education.

The notice gives the basis for ETS's role as a contract. It describes ETS as a nonprofit assessment organization under contract with the State of California to provide state and federally required testing.

It also explains the specific system involved. The notice describes an SFTP site that was used to exchange California statewide assessment information with the Department of Education.

The notice sets out how the access happened and over what period. It says an unauthorized party used a compromised login credential at various times from May 22, 2026 to September 18, 2026.

The notice also lists what was not taken. It states that the data accessed and copied did not include Social Security numbers, and it names other categories that were not included.

For readers who are now adults, the letter reaches back to their school years. The sender is a testing contractor that the reader may not remember, and the state agency's name sits in the first line to connect the two.

Lexitas: a vendor holding other people's legal documents

The third notice comes from a company whose customers, not the people named in the documents, chose to use it. The notice says Deposition Solutions, LLC, doing business as Lexitas, provides litigation support services, including court reporting and deposition transcript services.

The notice explains how the exposure was found. It says Lexitas learned from a customer on May 29, 2026 that a web server configuration error had made certain files in its OnDemand (DepositionNet) application accessible over the internet without authentication.

The notice gives the date the error began as well. It says the investigation determined that the configuration error occurred in or around September 2019 and was not detected at the time.

On what the files contained, the notice says the affected files consisted primarily of deposition transcripts, exhibits, and other legal documents. This answers why a person with no connection to the company can be named. A deposition transcript can contain a person's details because they gave testimony, or because they appear in an exhibit.

The notice also explains why identifying people took months. It says personal information in these documents is scattered throughout written testimony rather than organized in a searchable database, so identifying affected individuals required extensive manual review.

The letter is candid about what it cannot say. Lexitas states that, because available server logs were limited, it could not determine whether the reader's specific information was viewed, copied, or downloaded.

The notice gives a count in its Rhode Island paragraph. It says approximately 14,361 individuals nationwide were affected.

A second unfamiliar name: who runs the response

Some letters introduce a further party that the reader has also never heard of. The Lexitas notice says its fraud assistance services will be provided by Cyberscout, a TransUnion company specializing in fraud assistance and remediation services.

The Mercadien and ETS notices name Experian as the provider of their monitoring offers. A reader can therefore receive one letter that contains two unfamiliar names: the organization that held the data, and the company running the response.

What the letters offer, and the dates that matter

Each letter pairs its explanation with an enrollment offer, and each offer has an end date. The Mercadien notice tells readers to enroll by December 31, 2026 by 11:59 pm UTC, and states that the code will not work after that date.

The ETS notice sets a deadline for parents and guardians. It says a parent or legal guardian can enroll a student under age 18 in the minor identity-protection services on or before March 19, 2027.

The Lexitas letter and the Mercadien letter each give their own timing and contact details in the text. A reader should take each deadline from the letter that arrived, because the three notices use different dates and different providers.

What the three letters leave open

Taken together, the letters answer the "why me" question in three ways. One cites a service relationship with a financial institution. One cites a state contract and a state agency's direction. One cites a vendor role in handling legal documents. Each sentence that gives that reason is quoted above.

The letters do not all close the gap equally. The filed Mercadien copy shows a placeholder where the source of the data would appear. The Lexitas notice says it could not tell whether a given person's data was viewed. Neither of those limits is hidden in the text, and both are stated in the letters themselves.