Cybersecurity Incident at Thomson Reuters Affects Court Management Software, Exposing Sensitive Case Data
Thomson Reuters has recently made a significant disclosure regarding a cybersecurity incident that has impacted its court management software, specifically affecting sensitive case data across Canada and the United States. This development has raised concerns over the security of individuals’ personal information in relation to ongoing legal proceedings.
The company first identified irregular activity concerning its C-Track product, a digital platform designed for case management, on June 30. Following this detection, an investigation was initiated, which subsequently revealed that unauthorized access had led to the breach of certain files associated with three major Ontario courts—the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice.
In a statement released on September 2, Thomson Reuters noted that, based on findings from the investigation, a subset of court records was compromised. Alarmingly, some of these documents could contain personal identifiers, such as the names and personal information of individuals involved in various legal proceedings. Moreover, it was acknowledged that confidential, redacted, or sealed information may have also been included in the affected records for the courts mentioned.
This breach has not been limited to Ontario’s judicial system; it also extends to appellate courts across 11 states in the U.S. and the U.S. Virgin Islands. West Publishing Corporation, a U.S.-based subsidiary of Thomson Reuters that specializes in court management solutions, confirmed the extent of this incident in a separate statement. The states influenced by the breach include South Carolina, Nevada, New Hampshire, North Dakota, Ohio, Kentucky, Pennsylvania, Alabama, Montana, Tennessee, and another mention of North Dakota.
Following a thorough review, West Publishing disclosed that the records affected by the breach could encompass a wide range of sensitive personal data. This includes not only names but also critical information such as Social Security numbers, driver’s license numbers, medical records, dates of birth, and health insurance details. Much like the implications for Ontario, the potential impact on confidential, redacted, or sealed information remains a serious concern across the other affected jurisdictions.
As the investigation continues, efforts are underway to determine the specific content and types of information that have been compromised in each affected court. Additionally, the scope of the breach, including the number of individuals whose personal information may have been exposed, is yet to be fully established.
Thomson Reuters provided some reassurance, stating that there is currently no evidence to suggest that systems responsible for processing financial transactions were affected by this cybersecurity incident. However, details surrounding how access to the C-Track records was gained remain vague. The company has emphasized, notably, that the breach was not due to any flaws in the courts’ own networks, systems, or data security measures.
To date, there has been no evidence indicating that the compromised information has been misappropriated for fraudulent activities or any other malicious purposes. Nevertheless, the situation has generated considerable anxiety within the legal community and among individuals whose personal data may have been jeopardized.
Court Records at Risk of Exploitation
Court documents are increasingly recognized as a target by various threat actors, including employees of nation-states seeking sensitive information for espionage, malicious entities aiming to manipulate or disrupt legal proceedings, and cybercriminals who exploit sensitive court data for extortion schemes. The alertness surrounding such incidents isn’t without merit, especially given the escalating frequency of cyberattacks targeting judiciary systems globally.
In August 2025, the U.S. federal judiciary announced a slew of enhanced cybersecurity measures for sensitive court documents following reports of increased cyberattacks. This announcement came on the heels of revelations that the federal case filing system had also been compromised, leading to the exposure of sensitive court records across multiple U.S. jurisdictions.
As the digital landscape continues to evolve, the need for robust security measures to protect sensitive court data is more pressing than ever. The ongoing investigation into the Thomson Reuters incident may shed light on necessary improvements that can prevent similar breaches in the future and enhance the overall integrity of the court management systems utilized across North America.