Thomson Reuters C-Track Breach Exposed Sealed Court Data via Unrequested Vendor Backups
Thomson Reuters disclosed unauthorized access to C-Track court backups holding SSNs and sealed records affecting 24 judicial bodies. Multiple courts were unaware of retained vendor copies. The incident underscores judicial dependence on third-party infrastructure without adequate oversight of data copies.
West Publishing discovered the intrusion on June 30 after an attacker accessed cloud storage holding database copies supplied solely for troubleshooting. Multiple courts, including Alabama Appellate Courts, stated they had neither requested nor known about the retained backups. Montana Supreme Court confirmed the exfiltrated material included charge descriptions, docket entries, and driver license numbers for some defendants.
The breach highlights recurring supply-chain exposure in state judicial systems where vendors retain full database replicas outside court-controlled environments. Minnesota Judicial Branch terminated Thomson Reuters access and forced password resets, while Ohio courts received delayed notification on August 31. Sealed and redacted filings were explicitly at risk, yet the vendor has reported no detected misuse to date.
Affected individuals in the U.S. receive 12 months of Experian IdentityWorks monitoring via code B171847; Canadian courts offer TransUnion myTrueIdentity. No independent forensic report has been released, leaving open whether the actor targeted specific sealed matters or performed broad exfiltration.
Courts must now audit all vendor data retention agreements and implement mandatory deletion schedules for troubleshooting copies to reduce future exposure.
SENTINEL: At least three additional state court systems will publicly terminate Thomson Reuters access within 90 days after internal audits reveal similar unrequested backups.
Sources (2)
- [1]West Publishing Notice(https://www.thomsonreuters.com/en/court-notice)
- [2]Montana Supreme Court Release(https://courts.mt.gov)