Loading story…
Thomson Reuters disclosed that an unauthorized party accessed files in C-Track, its cloud-based court case-management platform, exposing data tied to courts in at least 12 US states, the US Virgin Islands, and Canada. The intrusion began in March and was detected on June 30; Montana officials indicated unauthorized access may have persisted through June. Affected organizations include three Ontario courts, appellate courts in 11 US states, and the North Dakota Supreme Court, which was notified in late July.
The compromised files may contain names, dates of birth, Social Security and driver’s-license numbers, medical and health-insurance details, and confidential, redacted, or sealed court records. Thomson Reuters said affected courts’ networks were not the source of the incident, C-Track remained operational, and financial-transaction systems were unaffected. The company contained the activity, secured the environment, engaged external incident-response experts, notified law enforcement and customers, and is offering 12 months of credit monitoring and identity-theft protection; no misuse of the data has been identified so far.
See attribution, scope, and your downstream exposure.
11 events from the most recent confirmed update back to the earliest known activity.
Ontario’s chief justices for the Court of Appeal, Superior Court of Justice, and Court of Justice posted a public notice that court records in C-Track had been accessed. They said the precise contents of the accessed files remained uncertain and that they would work with the Ontario government to strengthen security measures.
Thomson Reuters notified Montana's court administrator and Ontario's Ministry of the Attorney General that court data in C-Track had been accessed.
The North Dakota Court System said it was informed in late July that the third-party C-Track breach may have affected data associated with the North Dakota Supreme Court.
Thomson Reuters detected unauthorized activity affecting information held in its C-Track court case-management platform and began investigating the incident.
Thomson Reuters determined that an unauthorized party obtained certain files from its C-Track cloud court-management environment beginning in March; Montana officials said access may have continued through June.
The Montana Supreme Court confirmed that backup data associated with Montana's court system was compromised in the C-Track intrusion. Officials said their review identified some personally identifying information, including driver's license numbers and dates of birth, and continued reviewing the data with Thomson Reuters.
Thomson Reuters said it will offer affected individuals 12 months of free credit monitoring and identity-theft protection following the C-Track breach.
Thomson Reuters said it secured the affected C-Track environment, engaged external cybersecurity experts, notified law enforcement and affected customers, and added security measures. It reported no operational disruption to C-Track and no evidence at that time of fraud or misuse of exposed data.
Minnesota Judicial Branch said appellate-court data and court-user data were compromised in the C-Track incident. It terminated Thomson Reuters access to its courts' electronic environments and directed appellate case-management users to change their passwords.
Thomson Reuters disclosed that its subsidiary West Publishing Corporation was also affected by the C-Track court-management software incident. The company said it had no evidence that financial transaction systems were compromised or that exposed data had been misused.
Thomson Reuters publicly disclosed that C-Track files associated with courts in Canada, at least 12 U.S. states, and the U.S. Virgin Islands were affected. Potentially exposed data includes personal information and, for some courts, confidential, redacted, or sealed records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
15 references tracked. Mallory keeps watching after this page renders.
cbc.ca
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcecysecurity.news
Open sourcereuters.com
Open sourceontariocourts.ca
Open sourcectracknotification.ca
Open sourcectracknotification.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OnTrac, a U.S. parcel delivery company, notified customers that attackers breached its corporate network and accessed certain files containing personal information. The company said the unauthorized access occurred between March 20 and March 22 and was detected on March 23, prompting an internal investigation and the engagement of a third-party incident response specialist. The exposed information included customer names, though the full scope of compromised data was not publicly detailed because notification materials were redacted. OnTrac said it re-secured the affected data, verified it had not been distributed, and had not identified fraud or public leaks linked to the incident; the company is offering affected individuals 12 months of credit monitoring and identity protection through **CyberScout**.
Jul 28, 2026
DocketWise, an Austin-based provider of cloud case management and CRM software for immigration law firms, disclosed a data breach after attackers gained unauthorized access to a third-party partner repository and used valid credentials to clone repositories tied to a data migration pipeline for the DocketWise application. The company said it detected the activity in October and later reported that the incident affected at least **143,480 individuals**, while earlier public reporting had put the impact at roughly **116,000** people. The exposed information included names and highly sensitive personal data such as **Social Security numbers**, dates of birth, driver's license and passport numbers, bank account details, tax identifiers, health insurance and medical information, and non-financial account credentials. DocketWise said forensic investigators found no evidence of ongoing unauthorized access, dark web publication, or extortion linked to the stolen data, and the company reported the incident to the FBI while offering affected individuals two years of identity protection and credit monitoring services.
Jun 29, 2026
A significant data breach at RemoteCOM, a provider of surveillance and monitoring software for the US criminal justice system, has resulted in the exposure of highly sensitive personal information belonging to nearly 14,000 individuals under court supervision. The breach, attributed to a hacker known as "wikkid," targeted RemoteCOM's proprietary SCOUT software, which is widely used by law enforcement agencies across 49 US states to monitor pretrial, probation, and parole clients. SCOUT operates as a comprehensive surveillance tool, recording keystrokes, capturing screenshots, tracking locations, and sending alerts based on specific keywords typed by monitored individuals. The leaked data was split into two main files: one containing detailed records of monitored clients, and another listing thousands of criminal justice employees who used RemoteCOM's services. The "clients" file included names, home addresses, phone numbers, email addresses, IP addresses, and specific charges or offenses, ranging from sex offenses and narcotics to terrorism, stalking, and hacking. The "officers" file exposed the names, work addresses, phone numbers, email addresses, unique IDs, and job titles of nearly 7,000 criminal justice professionals. The breach has raised concerns about the security of surveillance data, especially given the sensitive nature of the information and the potential risks to both monitored individuals and law enforcement personnel. Some records labeled clients as "tech savvy," and the data also revealed the financial burden placed on offenders, with installation and recurring monitoring fees for each device. The exposure of such detailed information could lead to threats, harassment, or violence against both clients and officers, particularly as some clients may not have been convicted but were merely under investigation or awaiting trial. The hacker described the breach as "one of the easiest" they had ever carried out, highlighting possible weaknesses in RemoteCOM's security posture. The incident has prompted calls for greater scrutiny of surveillance technology vendors and the protection of sensitive data managed by third-party providers. The leak also underscores the broader risks associated with the use of aggressive spyware-like tools in the criminal justice system. Law enforcement agencies and affected individuals now face heightened risks of doxxing, identity theft, and targeted attacks. The breach has sparked debate about the ethics and oversight of digital monitoring in the justice system, as well as the responsibilities of vendors handling such critical data. Security experts warn that the fallout from this breach could be long-lasting, with the potential for further exploitation of the leaked information by malicious actors. The incident serves as a stark reminder of the need for robust cybersecurity measures in organizations handling sensitive personal and law enforcement data.
Jun 29, 2026