Loading story…
Arizona’s state court system was compromised after a court employee clicked a malicious link in a phishing email, allowing criminal hackers to copy compressed backup files containing personally identifiable information. The stolen material includes protective-order records and more than 150,000 Foster Care Review Board recommendation reports dating to 2010, potentially exposing highly sensitive information about Arizona residents.
The Arizona Supreme Court said it has no evidence that the data has been publicly released, and it has not identified the attackers, their motive, or a responsible ransomware group. The incident was not ransomware and no ransom demand had been received; the FBI is investigating while the Administrative Office of the Courts identifies and notifies affected individuals. Officials said available evidence does not indicate that juror, witness, or court-employee data was included.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Chief Justice Ann Scott Timmer disclosed that hackers copied personally identifiable information associated with many Arizonans. The court said it was notifying people believed to be affected and investigating with the FBI.
The copied backups included protective-order materials and more than 150,000 Arizona Foster Care Review Board recommendation reports, including current and historical child-care and protection cases dating back to 2010.
A court employee clicked a malicious link in a phishing email, allowing criminal hackers to compromise Arizona’s state court system and copy compressed backup files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcetherecord.media
Open sourceazcourts.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LulzSec launched its first **Operation Anti-Security** disclosure by publishing a torrent of files stolen from the Arizona Department of Public Safety, saying the attack was meant to embarrass law enforcement and protest Arizona’s `SB1070` immigration law. The archive, titled **“Chinga La Migra!”**, reportedly contained border patrol, counter-terrorism, warrant, court, and internal email documents, including material referencing informants used to infiltrate gangs, cartels, motorcycle clubs, Nazi groups, and protest movements. Arizona DPS said the breach appeared authentic and temporarily disabled its website and webmail systems while investigating. The campaign expanded as Anonymous and AntiSec affiliates released additional data allegedly taken from Arizona DPS systems and the personal email accounts of Arizona police officers. Reports said the later dumps exposed sensitive personal information including Social Security numbers, passwords, addresses, voicemails, chat logs, and other private content tied to roughly a dozen officers, while Arizona authorities said ongoing investigations and other critical operational data were not compromised. The disclosures also highlighted weak password practices among affected officers and prompted a joint criminal investigation, as AntiSec supporters threatened further attacks on police and government targets.
Jun 29, 2026
The Pennsylvania Office of the Attorney General suffered a ransomware attack in August 2025, resulting in the theft of files containing personal and medical information, including Social Security numbers. The attack, claimed by the INC Ransom gang, disrupted the office’s operations by taking down its website, email, and phone systems, and forced staff to use alternative communication methods for nearly a month. The breach was discovered on August 9, and subsequent investigation confirmed that sensitive data was accessed and stolen, though officials have stated there is no evidence of misuse so far. The ransomware group claimed to have stolen 5.7TB of data, and the office has notified affected individuals and the FBI. Security experts noted that the office had vulnerable Citrix NetScaler appliances exposed to the internet, which may have facilitated the breach. The incident caused significant disruption to Pennsylvania’s legal system, including delays in criminal and civil cases, but the office refused to pay the ransom demanded by the attackers.
Jun 29, 2026
DocketWise, an Austin-based provider of cloud case management and CRM software for immigration law firms, disclosed a data breach after attackers gained unauthorized access to a third-party partner repository and used valid credentials to clone repositories tied to a data migration pipeline for the DocketWise application. The company said it detected the activity in October and later reported that the incident affected at least **143,480 individuals**, while earlier public reporting had put the impact at roughly **116,000** people. The exposed information included names and highly sensitive personal data such as **Social Security numbers**, dates of birth, driver's license and passport numbers, bank account details, tax identifiers, health insurance and medical information, and non-financial account credentials. DocketWise said forensic investigators found no evidence of ongoing unauthorized access, dark web publication, or extortion linked to the stolen data, and the company reported the incident to the FBI while offering affected individuals two years of identity protection and credit monitoring services.
Jun 29, 2026