Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Thomson Reuters has disclosed a data breach affecting C-Track, a court case management platform operated by its subsidiaries, exposing court records and sensitive personal information across courts in at least 12 US states, the US Virgin Islands, and Canada.

The company published the disclosure publicly on Wednesday, along with separate notification pages for affected individuals in the United States and Canada.

What happened, and when

Thomson Reuters said it discovered unauthorized activity involving certain C-Track information on June 30, 2026, and launched an investigation with outside cybersecurity experts and law enforcement.

They determined that, in March 2026, an unauthorized third party obtained certain C-Track files associated with the following court systems:

• In Canada:
  • The Court of Appeal for Ontario
  • The Ontario Superior Court of Justice
  • The Ontario Court of Justice
• In the U.S.:
  • Alabama Appellate Courts
  • Court of Common Pleas of Monroe County (Ohio)
  • Court of Common Pleas of Washington County, Pennsylvania
  • Fifth Judicial District of Pennsylvania
  • Kentucky Appellate Courts
  • Montana Supreme Court
  • Nevada Appellate Courts
  • North Dakota Supreme Court
  • Supreme Court of South Carolina and the South Carolina Court of Appeals
  • Tennessee Appellate Court Clerk’s Office
  • The New Hampshire Supreme Court
  • The Ohio First, Second, Third, Fourth, Fifth, Sixth, Seventh, Ninth, Eleventh, and Twelfth District Courts of Appeals
  • U.S. Virgin Islands Supreme and Superior Courts
  • Wyoming Judicial Branch (i.e., the entire state court system of Wyoming)
  • The Commonwealth of Pennsylvania Environmental Hearing Board, which is a former client

The Oregon Judicial Department also confirmed its appellate courts have been affected.

(Because the scope has continued to expand as individual courts issue their own disclosures, the full list of affected jurisdictions is likely not complete.)

The company emphasized that the incident took place within its own (cloud) environment and was not caused by the networks, systems, or data security of the affected courts.

C-Track remains fully operational, they added, and additional security measures that were reviewed and approved by outside experts have been added.

Though the breach started in March and was discovered in June 2026, key questions about the breach remain publicly unanswered by Thomson Reuters: Who was responsible? How much and which data was taken? And, most importantly, how did the attacker gain access, and why did they remain unnoticed for months?

What information may have been accessed

The exposure appears to differ significantly by location.

According to Thomson Reuters, the affected records may have contained individuals’ names along with one or more of the following: Social Security numbers, driver’s license numbers, medical information, dates of birth, and health insurance information.

“Confidential, redacted, or sealed court information may also have been affected at some courts,” the U.S. notificiation states.

On the Canadian side, the chief justices of the three courts affected said it remained unclear exactly what information was compromised or how many people were affected.

“If individuals have been involved in court proceedings or may have been mentioned in court documents, it is possible that some personal information relating to them could have been involved in the incident,” the justices noted.

“The Ministry [of the Attorney General] and the courts continue to work closely with Thomson Reuters Canada and cybersecurity specialists to assess the impact of the incident and appropriate response measures.”

Thomson Reuters said it has no evidence to date that the exposed information had been used for fraud or otherwise misused, nor that systems used to process financial transactions were affected.

The company will be offering all affected individuals 12 months of free credit monitoring and identity theft protection.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!