Thomson Reuters C-Track Platform Breach Exposes US and Canadian Court Data

Court Data Breach Disclosed

Thomson Reuters announced a data breach impacting its C-Track court case management platform. The breach exposed sealed court information and sensitive personal data from various courts in the U.S. and Canada. Affected jurisdictions include courts in at least 12 U.S. states, the U.S. Virgin Islands, and Canada.

Scope of Compromised Data

The compromised data may include names, Social Security numbers, driver’s license numbers, medical information, dates of birth, and health insurance information. Confidential, redacted, or sealed information from some courts was also potentially affected. Thomson Reuters stated there is no evidence of fraud or misuse of the information as a result of this incident.

Incident Timeline and Investigation

Thomson Reuters discovered unauthorized activity on June 30, initiating an investigation with cybersecurity experts and law enforcement. The investigation revealed that an unauthorized party had obtained certain C-Track files as early as March. Montana’s Supreme Court indicated that unauthorized access persisted from March through June.

Affected Jurisdictions

U.S. appellate courts identified in the notice include those in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee, and Wyoming. Several Pennsylvania courts, 10 Ohio district courts of appeals, and the U.S. Virgin Islands Supreme Court and Superior Court were also named. The Oregon Judicial Department separately confirmed its appellate courts were involved, bringing the total known affected states to at least 12.

Company Response

Thomson Reuters clarified that the breach occurred within its environment and was not due to the security of the affected courts. The company has published notification pages for affected users and stated that the C-Track platform remains operational. New security measures have been implemented and reviewed by outside experts.