Breach in Thomson Reuters Court Software: SSNs and Sealed Records at Risk

On Wednesday, Thomson Reuters disclosed an incident affecting C-Track — the court case management platform sold by its West Publishing division. An unauthorized party gained access to the files back in March 2026, but the activity itself was not detected until June 30. The public disclosure came on September 2: according to Montana, the date was coordinated so that the vendor and all affected states would issue their statements simultaneously.

What May Have Leaked

Some court records may have contained names, Social Security numbers, driver's license numbers, dates of birth, as well as medical and insurance information. West Publishing acknowledged that for certain courts, “confidential, redacted, or sealed” materials may have been compromised, although there is no evidence of fraud or misuse so far.

Roughly 24 judicial bodies across 11 states and the Virgin Islands were affected, along with the appellate courts of Ontario. Those affected are being offered a year of free credit monitoring — Experian IdentityWorks in the U.S. and TransUnion in Canada.

Accounts Diverge

Curiously, the courts describe the incident differently. The Montana Supreme Court claims that backup copies of databases were stolen — copies that had been handed over to Thomson Reuters “to troubleshoot application issues.” The Alabama appellate courts only learned that their data had been stored in a backup file in the vendor's cloud — a copy that, by their own account, they had neither requested nor been aware of. “The incident occurred in our vendor's systems, not our own,” stressed Alabama Chief Justice Sarah Stewart.

The Ohio Supreme Court, however, paints a different picture: on August 31, it was informed that access had been gained to the court's “production platform,” which hosts the filing system data for ten appellate districts. Ohio complains that it has still not received details about the “enhanced security measures” the vendor said it had put in place.

The Courts Respond

Minnesota, which did not appear on West Publishing's list, nevertheless confirmed a compromise of its appellate courts' data, cut off Thomson Reuters' access to its systems, and required users to change their passwords. State Chief Justice Natalie Hudson said she was “deeply concerned.”

In Wyoming, historical data from 2015–2025 was affected; in North Dakota, a criminal investigation has been opened; and the Ontario courts admitted that it is still unclear exactly what information was compromised.

Thomson Reuters assured Reuters that there had been no operational disruptions to C-Track and that the platform is safe for continued use. As of September 3, no one had named the number of victims, the method by which the files were stolen, or those responsible.

Source: The Hacker News