Thomson Reuters disclosed on September 2, 2026 that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing Corporation unit, in an intrusion the company says occurred in March 2026, according to Thomson Reuters’ own disclosure and reporting by Reuters and The Hacker News.
Scope: 11 States, the U.S. Virgin Islands and Ontario
West Publishing said it discovered the unauthorized activity on June 30, 2026 and notified affected courts and Ontario’s Ministry of the Attorney General between July 23 and July 27. According to the company’s notice, a subset of affected court records could contain individuals’ names, Social Security numbers, driver’s license numbers, dates of birth, medical information and health insurance information. Some states reported that only backup data was involved, while Ohio said its production platform was accessed; Montana and Minnesota said court documents themselves were not part of the accessed data, though the vendor’s notice indicates sealed material may have been affected for certain courts.
Coordinated, Delayed Public Disclosure
Public disclosure came more than two months after the affected courts and Ontario were notified. Montana officials said the September 2 disclosure date was chosen so that the vendor and the various affected states could issue simultaneous announcements. Thomson Reuters said it has found no evidence to date that the exposed data has been misused.
Why It Matters
Court case management platforms sit at a sensitive intersection of physical and information security: they hold sealed records, victim and witness information, and identity data whose exposure carries legal as well as privacy consequences. The incident underscores the exposure created by shared third-party software used across many independent government bodies, where a single vendor compromise can cascade into simultaneous notifications across multiple jurisdictions.
Leave a Reply