As reported by The Hacker News, Thomson Reuters has disclosed that an unauthorized party exfiltrated files from C-Track, its West Publishing Corporation court case management platform, in March 2026 — with the intrusion not discovered until June 30, 2026. The breach affects 24 court bodies across 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada, with exposed data potentially including Social Security numbers, driver's license numbers, dates of birth, medical information, and health insurance details.
What elevates this incident beyond an already serious data breach is West Publishing's own acknowledgment that
certain confidential, redacted or sealed information may have been impacted for certain affected courts.Sealed court records are sealed for specific, often safety-critical reasons: protecting confidential informants, undercover officers, minors, domestic violence survivors, grand jury materials, and parties in sensitive civil matters. Exposure of this category of data carries risks that extend well beyond identity fraud — potentially endangering physical safety and compromising active or concluded legal proceedings.
Why the Three-Month Detection Gap Matters
The intrusion occurred in March but wasn't identified until late June. That dwell time is significant. In data exfiltration scenarios, threat actors typically spend that window staging additional access, mapping data repositories, and identifying high-value targets. For a platform housing sealed judicial records, three months of undetected access suggests the attacker had opportunity to selectively target sensitive records rather than simply bulk-exfiltrating whatever was accessible. Defenders and affected courts should operate under the assumption that exposure was targeted, not incidental.
Third-Party Risk in the Judicial Sector
This incident underscores a structural vulnerability in the U.S. court system: judicial bodies increasingly rely on commercial vendors for case management, e-filing, and records platforms, yet those vendors become single points of failure for extraordinarily sensitive data. The Minnesota Judicial Branch's decision to terminate Thomson Reuters' access to its electronic environments and force password resets is a telling response — it signals that even the affected courts are questioning whether the vendor's security posture is adequate for the trust placed in it.
Court systems typically lack the cybersecurity budgets and staffing of federal agencies or large enterprises, making vendor concentration risk especially dangerous. When one platform serves 24+ judicial bodies across multiple jurisdictions, a single compromise cascades nationally.
Who Is Most at Risk
Shield53 Recommendations
For Affected Courts and Judicial Bodies
- Conduct an independent forensic review — do not rely solely on vendor-provided scope. Engage third-party DFIR to determine exactly which sealed records were accessed and whether any exfiltration occurred after the March window.
- Audit access logs for C-Track and interconnected systems — identify whether the initial intrusion lateralized into court networks or other vendor integrations.
- Review all sealed cases in affected courts — assess whether exposed sealed information creates safety risks for named parties and initiate protective measures (address changes, law enforcement notification) where warranted.
- Reassess vendor security requirements — mandate SOC 2 Type II, independent penetration testing, breach notification SLAs under 72 hours, and contractual right-to-audit for all court technology vendors.
- Implement data minimization — require that SSNs and other sensitive identifiers be redacted or replaced with case reference numbers in case management systems wherever legally permissible.
For Potentially Affected Individuals
- Enroll in the offered credit monitoring immediately — Experian IdentityWorks (U.S., enrollment through December 31, 2026) or TransUnion myTrueIdentity (Canada, call center opening September 4).
- Place a security freeze with all three major credit bureaus — this is more protective than monitoring alone and is free under federal law.
- Monitor for targeted threats — individuals in sealed cases involving safety concerns should alert local law enforcement and consider whether additional protective measures are appropriate.
- Watch for legal document fraud — exposed court records can be used to fabricate filings, impersonate parties, or exploit knowledge of sealed proceedings. Monitor court case status for any unauthorized filings.
For the Broader Judicial Technology Sector
- Adopt zero-trust architecture for court records access — no vendor should hold persistent broad access to sealed record repositories.
- Implement just-in-time access with full audit logging for any third-party support or maintenance connections.
- Establish sector-wide incident response protocols — the judicial system lacks a coordinated cyber incident framework comparable to what exists in healthcare or finance.
The 12-month credit monitoring offering is, frankly, insufficient for this breach profile. Sealed court records don't expire in 12 months — the safety and privacy implications can persist for years. Affected jurisdictions should be preparing for long-term monitoring and remediation, not treating this as a standard notification event.
