Arizona Court Breach via Phishing Pulls 1.3M Records Including 30k Protection Orders

The attack copied names, addresses, and violation histories for traffic and criminal cases spanning three decades, plus foster-care board reports from 2010 onward. No juror, witness, or employee data was taken and no records were altered or deleted. The Arizona Supreme Court stated the intrusion was contained on a backup server and that notifications to affected individuals have begun. Procurement and retention patterns explain the scale: courts maintain decades-old fine and restitution ledgers for collection purposes, creating an archive whose value to identity thieves or stalkers exceeds current operational need. Similar state-court incidents in 2022-2023 show phishing remains the dominant initial vector when multi-factor authentication is absent on administrative systems. Independent confirmation of the 1.3 million figure rests on the court’s own disclosure; no external forensic report has been released. The two-hour detection window indicates logging was sufficient for containment but insufficient to prevent exfiltration once the link was opened. Notifications are complete and the FBI is assisting, yet the absence of public indicators of compromise or dark-web monitoring results leaves open whether the data set has already been packaged for sale. Other state judiciaries using the same case-management vendor should audit backup-server access controls within 30 days.