A Breach at Thomson Reuters (see details) Reaches Appellate Courts in Twelve US Jurisdictions
Files from the C-Track case management platform were taken in March and detected on 30 June, with notices describing social security numbers, medical information and some sealed documents.
September 3, 2026 – 7:58 am
Behind the scenes look at the Thomson Reuters office branding and logo display.
Credit: Thomson Reuters
Thomson Reuters states an unauthorized party accessed files belonging to C-Track, its case management platform sold to judiciaries. The records originated from appellate courts in a dozen US jurisdictions and Ontario, Canada.
The company identified the breach on June 30th, per Reuters, which is owned by Thomson Reuters. While the intrusion occurred in March, public disclosure came only on September 2nd.
Affecting Jurisdictions:
- Alabama
- Kentucky
- Montana
- Nevada
- New Hampshire
- North Dakota
- Ohio
- Pennsylvania
- South Carolina
- Tennessee
- Wyoming
- US Virgin Islands
- Ontario, Canada
Minnesota’s judicial branch also disclosed an exposure later that week, potentially expanding the affected jurisdiction count.
Sensitive Data Involved:
Notices sent to court users revealed names alongside Social Security numbers, driver’s licence numbers, medical information, dates of birth and health insurance information. Minnesota additionally warned some confidential or sealed documents may have been compromised.
Court records are uncommon breach targets due to their valuable contents: protective orders, sealed juvenile matters, and medical filings can be monetized based on the personal data they contain.
Thomson Reuters assured no operational disruptions occurred on the platform itself and that "our products and services remain fully operational." They engaged external cybersecurity experts and notified law enforcement.
Individual courts expressed concern:
- “Deeply troubled that our court users’ data has been compromised,” said Minnesota Supreme Court Chief Justice Natalie Hudson.
- Montana Chief Justice Cory Swanson stated his courts will continue working with the C-Track team "to ensure our courts operate without fear of compromise of personal privacy."
Remediation efforts include:
- 12 months of credit monitoring and identity theft protection offered by Thomson Reuters
- A dedicated call center
- Mandatory password resets for system users