Thomson Reuters C-Track Breach Exposes SSNs and Sealed Court Records Across 11 States

Thomson Reuters has not publicly disclosed the technical access vector for the C-Track breach. The company confirmed that an unauthorized party obtained certain C-Track files in March 2026 and that the activity went undetected until June 30, 2026, when Thomson Reuters launched an investigation with outside cybersecurity experts and law enforcement.

C-Track is a web-based case management platform delivered as a hosted service to court clients. The system centralizes sensitive case data including party information, filing documents, case history, and in some jurisdictions, sealed or expunged records. As a hosted platform, courts using C-Track have no direct visibility into, and no independent control over, the security of Thomson Reuters' underlying infrastructure, application layer, or data storage.

The 92-day detection gap is a defining characteristic of this breach. Modern threat intelligence firms consistently find that well-resourced attackers operating in third-party environments go undetected for 24 to 48 days on average. Ninety-two days gives an attacker substantial time to exfiltrate structured case data, identify sealed records by type, enumerate individuals by Social Security number or case number, and establish persistent access for future operations.

The supply chain structure of the breach means affected courts bear notification and legal obligations without having been the entry point. Courts that outsourced case management to Thomson Reuters now face state-law breach notification deadlines, potential liability from affected individuals, and the reputational consequence of a breach they could not have independently detected or prevented.

The C-Track breach affected 24 court organizations across 11 US states, the US Virgin Islands, and Ontario, Canada. Thomson Reuters confirmed affected jurisdictions include appellate and trial courts in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio (multiple appellate courts), New Hampshire, and Wyoming. Minnesota appellate courts and US Virgin Islands courts are also confirmed. Several Ontario appellate and superior courts are among the affected Canadian jurisdictions.

The affected courts are predominantly appellate-level institutions. Appellate courts handle case records on appeal from lower courts and typically maintain the most comprehensive case records, including full transcripts, evidence summaries, party information from all proceedings, and in some cases, sealed documents carried forward from lower court proceedings.

For legal sector security teams, the key classification is supply chain breach. None of the 24 affected organizations suffered a compromise of their own infrastructure. The Thomson Reuters C-Track platform, which they contracted to manage their case data, was the entry point. Courts that entrusted their most sensitive records to a single commercial vendor had no independent mechanism to detect the breach.

Verizon's 2026 Data Breach Investigations Report documented a 60% year-over-year increase in third-party breach involvement, with 48% of confirmed data breach incidents now involving a third-party component. The C-Track incident follows this trend and reinforces that vendor access to sensitive data requires equivalent security scrutiny to direct network access.

The exposed data spans five categories of sensitive personal information: Social Security numbers, driver's license numbers, dates of birth, medical information, and health insurance information. This data was embedded in case records for individuals who appeared as parties, witnesses, or subjects in court cases at affected jurisdictions.

Sealed court records represent a specific layer of elevated harm. Courts seal records to protect sensitive case types, including juvenile criminal proceedings, victims of domestic violence and sexual assault, expunged criminal records, involuntary mental health commitments, and family law matters involving minor children. Individuals who had records sealed precisely to protect their privacy now face the possibility that protection has been breached. In some jurisdictions, the existence of a sealed record is itself confidential, meaning even confirming exposure creates a secondary disclosure problem.

Medical information in court records typically appears in workers' compensation cases, personal injury litigation, criminal sentencing where medical conditions are a mitigating or aggravating factor, and mental health commitment proceedings. Exposure of this information implicates HIPAA for health system parties, state health privacy laws, and the state breach notification statutes governing each affected jurisdiction.

The combination of SSN, DOB, and driver's license number creates a complete synthetic identity fraud package. Attackers with this data can open credit accounts, file fraudulent tax returns, make medical insurance claims, and conduct targeted social engineering against attorneys, judges, or corporate litigants whose case data now resides with a third party of unknown identity and intent.

Court case management data is among the most valuable structured personal data available to attackers for three reasons. First, it is comprehensive and verified. Parties to litigation are required to provide accurate identifying information under penalty of perjury. Court records contain confirmed SSNs, verified addresses, and real medical histories that have been validated through the judicial process. Attackers who acquire court data bypass the normal information-quality problem they face with purchased credential dumps.

Second, court data spans every sector. A single appellate court database contains records for individuals from every industry, income bracket, and sector. A breach of a court case management system reaches targets that would be inaccessible through any single private sector data breach.

Third, sealed records create unique leverage. An attacker with access to sealed criminal records, expunged convictions, or sealed family court proceedings possesses information that the judicial system explicitly determined should remain private. This creates conditions for targeted extortion, blackmail, or reputational attacks against individuals who believed their records were legally protected.

The legal sector has historically underinvested in third-party cybersecurity governance. Law firms and courts that handle sensitive client and case data frequently delegate infrastructure security to vendors without contractual security requirements, audit rights, or breach notification timelines. A third-party vendor risk questionnaire process that covers data classification, minimum encryption standards, incident notification requirements, and right-to-audit provisions is the foundational control that the C-Track incident makes visible.

Thomson Reuters has not published specific network indicators for the C-Track breach. No attacker infrastructure, command-and-control IPs, domains, or malware hashes have been publicly confirmed as of September 4, 2026.

The following behavioral indicators are derived from known bulk data access and credential abuse patterns associated with this threat class. These are structural detection indicators, not confirmed attacker infrastructure. They are intended for detection engineering teams to identify similar unauthorized access against their own hosted case management or legal records platforms. Validate against your environment before deploying as production alert rules.

For organizations that use SonicWall SMA1000 appliances as VPN gateways connecting to court networks: those appliances were confirmed under active exploitation via CVE-2026-83548 and CVE-2026-83549 as of September 1, 2026 (CISA KEV deadline September 5). While there is no confirmed link between the SonicWall campaign and the C-Track breach, organizations with unpatched SMA1000 appliances providing network access to court systems should treat those systems as potentially compromised and investigate access logs immediately.

No CVE-specific community Sigma rules exist for the C-Track breach since this is a vendor infrastructure incident rather than a disclosed software vulnerability. These two rules were generated by Decryption Digest from the threat's known access patterns: bulk unauthorized record harvesting via a web-based case management interface and anomalous after-hours credential use. Both carry status: experimental. Validate against your environment before production deployment.

Deploy these rules against web application access logs from any hosted legal, court, or case management platform. For the retrospective hunt, request log exports from Thomson Reuters or your case management vendor for the full March 1 to June 30, 2026 window and feed them into your SIEM.

Courts and legal organizations using C-Track should take immediate steps to assess exposure and initiate breach notification. Individuals with court cases in affected jurisdictions should protect themselves against identity fraud now. A data breach response and notification guide covers mandatory breach notification obligations by state, including timelines that apply to some of the affected jurisdictions.

The C-Track breach illustrates a structural risk that applies to every organization that outsources sensitive data management to a commercial vendor: you carry the legal obligations and reputational consequences of a breach you cannot independently detect, prevent, or contain.

Court case management systems occupy a uniquely sensitive position. They hold verified, court-mandated personal data from every sector, including sealed records that courts determined required special legal protection. A 92-day dwell time means an attacker had sufficient access to perform systematic data exfiltration, index sealed records by type, and build structured profiles on every individual in the database.

For legal sector organizations, the C-Track breach is a forcing function for supply chain security governance. Every piece of case data delegated to a SaaS or hosted vendor is data your organization can no longer guarantee the security of independently. Vendor security reviews, contractual audit rights, 48-hour notification requirements, and data minimization policies are not optional when the data involved includes Social Security numbers, medical records, and sealed judicial proceedings.

For security teams across sectors, the December 31, 2026 enrollment deadline for credit monitoring is your operational clock. Courts responsible for notifying affected parties need to complete that outreach well before December 31, not arrive at that date still initiating it.