Thomson Reuters cyber breach exposes court data across US, Canada, threatening sensitive records

Thomson Reuters disclosed a cybersecurity breach affecting its C-Track case management software, with unauthorized access to court data in multiple US states and Canada, according to statements from the company, West Publishing Corporation and Ontario’s chief justices.

The incident was detected on June 30, 2026, when Thomson Reuters observed unauthorized activity in one of its cloud environments, the three chief justices of Ontario said in a statement. The company contained the threat, engaged external cybersecurity experts and notified law enforcement. A subsequent investigation found that an unauthorized party obtained certain C-Track files.

West Publishing Corporation, a Thomson Reuters subsidiary that operates as Thomson Reuters Court Management Solutions, confirmed that the breach affected C-Track systems used by appellate courts. A Reuters report cited by RTTNews said the incident hit court systems in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire, Wyoming and the US Virgin Islands. Infosecurity Magazine reported a similar list, including South Carolina, Nevada, New Hampshire, North Dakota, Ohio, Kentucky, Pennsylvania, Alabama, Montana, Tennessee and North Dakota.

In Canada, the breach affected three Ontario courts: the Court of Appeal for Ontario, the Ontario Superior Court of Justice and the Ontario Court of Justice, Thomson Reuters wrote in a September 2 statement.

Types of data potentially exposed

West Publishing said the affected court records could contain individuals’ personal information, including names, Social Security numbers, driver’s license numbers, medical information, dates of birth and health insurance information. Thomson Reuters added that certain confidential, redacted or sealed information may have been impacted for certain affected courts.

In Kentucky, where the Administrative Office of the Courts (AOC) uses C-Track for the state Supreme Court and Court of Appeals, the exposure is limited to appellate data stored within the Thomson Reuters CMS infrastructure, the AOC said. Trial-level records that were never part of an appeal remain unaffected because Kentucky does not use third-party vendors for trial court e-filing.

The Ontario chief justices warned that personal information belonging to people involved in court proceedings or mentioned in court documents may have been included. There is no evidence to date of identity theft, Thomson Reuters Canada said, and systems used to process financial transactions related to court proceedings were not affected.

Ongoing investigation and response

Thomson Reuters said it is coordinating with third-party cybersecurity specialists and law enforcement, and has implemented mitigation measures to reduce the risk of future unauthorized access, according to the Kentucky AOC. The company is reviewing each affected court system individually to determine what data was exposed and which individuals or organizations warrant notification. The review will take time given the multi-state scope.

The Kentucky AOC has pressed for a faster timeline, telling Thomson Reuters CMS that it expects prompt resolution and swift notification to anyone impacted, the Kentucky AOC said. Thomson Reuters CMS will handle notification and cover all associated costs. Affected individuals will receive 12 months of complimentary credit monitoring and identity theft protection, funded by the company.

The Ontario courts are working with the province’s Cyber Security Division, Thomson Reuters Canada and cybersecurity specialists. Thomson Reuters Canada has set up a dedicated information website and plans to launch a toll-free Canadian call centre on September 4.

Thomson Reuters shares closed down 0.45% at $105.87 on Wednesday, according to RTTNews.

Broader context

Court documents are a known target for threat actors, including nation-state groups for espionage and financially motivated cybercriminals seeking extortion opportunities, Infosecurity Magazine noted. In August 2025, the US federal judiciary announced stronger cybersecurity protections for sensitive court documents following “recent escalated cyber-attacks” on its case management system, after reports that the federal case filing system was breached and exposed documents in multiple states.

The incident was not caused by the courts’ own networks, systems or data security, Thomson Reuters emphasized.