Thomson Reuters C-Track Court Platform Breach: Judicial Records Including SSNs Leak Across 11 States
Thomson Reuters court case-management platform C-Track suffered unauthorized access affecting courts in 11 U.S. states and Ontario, Canada. Exposed data may include Social Security numbers, driver's license numbers, and sealed filings.
Thomson Reuters confirmed that C-Track, the court case-management platform operated by its West Publishing unit, was accessed by an unauthorized party. The incident affects court systems in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. The Minnesota judicial branch said leaked data may include Social Security numbers, driver's license numbers, and medical information, and may even cover litigation records that should have remained sealed.
Overview
C-Track is Thomson Reuters' case-management and public-search platform for appellate courts and other judicial bodies. The intrusion was discovered in June; subsequent investigation showed impact across 11 U.S. states and Canadian jurisdictions. Minnesota's judicial branch confirmed appellate-court data exposure, cut Thomson Reuters' access to its systems, and forced password resets for affected users.
Technical details
Official notices so far only state that an unauthorized party obtained files on the C-Track platform. Intrusion path, attacker identity, and exact volume of stolen data have not been disclosed. The real sensitivity is data type: sealed filings in court systems are supposed to be limited to judicial personnel. Once leaked, parties' physical safety and privacy protections become hollow. Combined with SSNs and driver's license numbers, attackers have a complete kit for targeted identity theft and directed extortion.
Impact
- Scope: court systems in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada.
- Data types: personal information including names, Social Security numbers, driver's license numbers, medical information, sealed filings.
- Risk: high. Sensitivity and non-replaceability of judicial records (an SSN leak cannot be reset like a password) mean long-lived impact.
Remediation
- Agencies using judicial SaaS should immediately audit third-party vendor access, enforce least privilege, and enable access-log review.
- Rotate passwords on systems with credential exposure and alert on anomalous query behavior.
- Affected individuals should monitor credit reports and watch for phishing calls and emails impersonating courts—judicial data leaks are routinely followed by targeted social-engineering fraud.
- When procuring judicial/government cloud services, write data isolation, breach-notification deadlines, and audit rights into the contract.
Sources
- Check Point Research: 7th September Threat Intelligence Report
- Secret CISO: 9/7 Security Briefing