Thomson Reuters C-Track Cyberattack Hits Courts Across U.S. and Canada

A Thomson Reuters unit has disclosed a cybersecurity incident involving its C-Track court case management platform, affecting court systems across 11 U.S. states, the U.S. Virgin Islands and Canada.

The company detected the security incident on June 30, according to a notice issued Wednesday and a statement from the chief justices of three Ontario courts that use C-Track to manage digital court records.

Thomson Reuters later determined that an unauthorized party had obtained certain C-Track files in March. Some affected court records contained names and other personal information, according to a website established by the company to provide updates about the breach.

West Publishing, a Thomson Reuters unit, said affected U.S. court systems included those in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire and Wyoming, as well as the U.S. Virgin Islands.

In Canada, the Court of Appeal for Ontario, Ontario Superior Court of Justice and Ontario Court of Justice said Thomson Reuters identified unauthorized activity within one of its cloud environments.

The company worked with Ontario's Ministry of the Attorney General and the courts to contain the incident. Thomson Reuters also brought in outside cybersecurity specialists, contacted law enforcement and secured the C-Track environment, according to the Ontario courts.

Thomson Reuters said affected customers have been notified and emphasized that the cyber incident did not disrupt C-Track operations.

"There has been no operational disruption to C-Track as a result of this incident," a company spokesperson said, adding that its products and services remain operational and safe to use.

The exact scope of the compromised information remains unclear. Ontario's chief justices warned that people involved in court proceedings, or individuals named in court documents, may have had personal information affected.

The identity of the party responsible for the cybersecurity breach has not been determined publicly, while specific details about the compromised data remain unavailable.

Thomson Reuters Canada plans to establish a call center beginning September 4 to handle inquiries. The company said it is also responding to questions from affected parties in both the United States and Canada.