In a latest update a new site, Thomson Reuters confirmed that an unauthorized third party gained access to backup data files within its C-Track case management system, affecting court systems across multiple U.S. states, the U.S. Virgin Islands, and Canada.
Investigations revealed that the unauthorized intrusion and file access took place over a multi-month window between March 1 and June 29, before being discovered and contained.
The news website said, the company’s investigation found some court records were “affected” and they included names and personal information.
While a significant portion of the compromised files consisted of publicly available court docket data, state officials and internal reviews confirmed that some files contained Personally Identifiable Information (PII), including names, dates of birth, driver’s license numbers, and in certain instances, sensitive health or financial details.
The news aggregator has notified affected state court administrators and impacted individuals, offering 12 months of free credit monitoring and identity theft protection services.
The company verified that the breach originated on its own storage servers rather than through vulnerabilities in state court networks.
A website set up by the West Publishing unit of Thomson Reuters to answer questions about the hack said it hit court systems in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire, Wyoming and the U.S. Virgin Islands.
The statement from the chief justices of the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice said Thomson Reuters detected unauthorized activity in one of its cloud environments, and had taken steps to contain the activity, working with Ontario’s Ministry of the Attorney General and the courts.
“We are advised that Thomson Reuters responded by taking steps to contain the activity, engaging external cybersecurity experts to advise and investigate, notifying law enforcement, and securing the C-Track environment,” the statement said.
However, it is unclear what information may have been compromised, the chief justices’ statement said.
They said that individuals involved in court proceedings or mentioned in court documents could have had personal information relating to them involved in the incident.
