Court-Software Breach May Expose Social Security Numbers and Sealed Records Across 11 States

Unauthorized party obtained court-platform files

An unauthorized party obtained files from C-Track, a court-management platform owned by West Publishing Corporation, in a cybersecurity incident affecting court systems in 11 states, the U.S. Virgin Islands and Ontario, according to the vendor and official court statements released Wednesday.

C-Track says it discovered unauthorized activity on June 30 and determined during its investigation that a third party had obtained certain files in March. The company says a subset of affected court records could contain names and one or more sensitive identifiers, including Social Security numbers, driver’s-license numbers, dates of birth, medical information and health-insurance information. It also warns that confidential, redacted or sealed material may have been involved for some courts.

The notice does not establish that every category of information was present in every accessed file, that every person named in an affected court system was exposed, or that the information has been misused. C-Track says it has found no evidence of fraud or misuse to date, but the precise number of people affected and the records involved remain undetermined.

Read the source: C-Track: Official U.S. incident notice, affected courts and protective services ↗

The published list covers 11 states—not California

The vendor lists affected court systems in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire and Wyoming, along with the Supreme and Superior Courts of the U.S. Virgin Islands. Several entries cover only specified appellate courts, counties or judicial districts rather than an entire state judiciary.

California is not on C-Track’s published list of affected U.S. court systems. That means no California court impact is confirmed in the notices reviewed for this report; it does not prove that every California resident is unaffected, because people can appear in court records outside the state and the investigation is continuing.

Ontario’s three chief justices separately confirmed that accessed data included information from the province’s courts. They said people involved in proceedings or mentioned in court documents may have had personal information involved, but the exact content and number of individuals remain unclear.

Read the source: North Dakota Court System: Official statement on affected Supreme Court data ↗

North Dakota confirms Supreme Court data was affected

The North Dakota Court System says C-Track confirmed that data associated with the state Supreme Court was affected. It says district-court data and the separate Odyssey system were unaffected, and there is no evidence that nCourt, which processes financial transactions, was involved.

North Dakota officials say the incident originated within C-Track’s systems, not the state court network, and did not interrupt court-system functionality. The court was notified July 23 and says an active criminal investigation is limiting some of the information available publicly.

Operational continuity is important, but it is not the same as data security. A platform can remain available while copied files create a separate risk of identity theft, medical-privacy violations, targeted scams or exposure of information that was supposed to remain sealed.

Read the source: Ontario Courts: Joint statement by the province's three chief justices ↗

Systems remain online as the criminal investigation continues

Thomson Reuters says there was no operational disruption and that C-Track remains safe to use. The company says it contained the activity, secured the environment, hired outside cybersecurity experts, notified law enforcement and had its remediation measures independently validated.

Ontario’s courts likewise say their ability to hear and decide cases was not affected. No government or company statement reviewed for this report identifies the unauthorized party, describes the access method or says whether the incident involved ransomware, extortion or a nation-state actor.

Reuters reported the incident nationally but also disclosed that Reuters News is a division of Thomson Reuters. Its report was checked against the vendor’s direct notice and independent statements from the North Dakota and Ontario court systems.

Read the source: Reuters: National report and Thomson Reuters response ↗

What potentially affected people can do now

C-Track is offering 12 months of Experian IdentityWorks credit monitoring and identity-theft protection, with enrollment information on its incident website. The company says affected people will be notified directly when the investigation determines who was involved and what information was present.

North Dakota court officials advise people who interacted with its courts to monitor account statements and credit reports and to be cautious of unsolicited messages requesting personal information. A caller or email sender who knows a real case detail is not automatically legitimate; sensitive court data can make phishing attempts sound convincing.

The firm’s incident notice provides a U.S. support line at 1-833-918-5294, Monday through Friday from 8 a.m. to 8 p.m. Central time, excluding major holidays. People should use contact information from the official C-Track notice rather than links or phone numbers delivered in an unexpected message.

Read the source: Kentucky Lantern: Kentucky appellate-court system affected ↗

The biggest questions are still unanswered

The confirmed facts are serious: an unauthorized party obtained court-platform files; affected records may contain high-risk identifiers and sealed material; multiple U.S. and Canadian courts are involved; and a criminal investigation is underway.

Still unknown are the attacker’s identity, the entry point, the total number of files and people affected, which data fields were present for each person, whether copies were distributed and whether any additional court systems will be identified.

What’s the Scoop With Broach will update this report when the vendor or affected courts publish a verified scope, direct-notification count, evidence of misuse or attribution to a responsible actor. Until then, claims that all court users were compromised—or that no one faces risk—go beyond the evidence.

The accompanying image is an authentic 2016 U.S. Navy file photograph of system administrators testing network racks at a San Diego facility. It is public-domain context and does not show C-Track, Thomson Reuters, an affected court, the unauthorized access or the investigation.

Read the source: Wikimedia Commons: Public-domain U.S. Navy network-rack photograph ↗