Thomson Reuters breach exposes US and Canadian court records

Thomson Reuters has disclosed a data breach at C-Track, the court case-management system run by its West Publishing Corporation unit, affecting records held for a list of US and Canadian courts. The official notice, dated 2 September 2026, says the incident occurred in C-Track's cloud environment, not on the courts' own networks.

Read this as a vendor incident notice, not a court-network intrusion. It does not say every sealed file was taken. West Publishing describes a subset of records that may have been affected, and says the investigation is still ongoing.

The timeline is the part the headlines skip. West Publishing says it detected unauthorized third-party activity on 30 June 2026, and its investigation later found the access had actually happened back in March 2026, when an unauthorized party obtained certain C-Track files. That is a gap of roughly three months between intrusion and discovery.

The notice lists appellate and other courts across a wide spread of US jurisdictions, including Alabama, several Pennsylvania courts, Kentucky, Montana, Nevada, North Dakota, Oregon, South Carolina, Tennessee, New Hampshire, multiple Ohio districts, the US Virgin Islands and Wyoming, with the full roster on the notice itself. North Dakota's court system reproduced the vendor notice in full, and in Canada, Ontario courts were notified through a separate release.

For a subset of records, the possible data includes names together with one or more of Social Security numbers, driver's licence numbers, medical information, dates of birth and health insurance details. West Publishing says some confidential, redacted or sealed information may have been impacted for certain courts.

The picture is narrower in at least one state. South Carolina's Judicial Branch, in a statement carrying West Publishing's release, said its preliminary review suggests the affected data is backup information for appellate cases from 2020 and earlier, and that it has not confirmed any personal information in its own subset was exposed. That is South Carolina's early read, not a finding that applies to every court on the list.

West Publishing says it found no evidence that financial-transaction systems were involved and no evidence of fraud or misuse so far. C-Track remains operational, additional security measures have been added, and affected people are being offered 12 months of credit monitoring. The Record and Help Net Security covered the disclosure.

Who carried out the intrusion, exactly how they got in, and how many records were taken are not public, and the scope is still under review. Some state statements are already narrower than the vendor's list of possible data types, so the ceiling in the notice is not the confirmed floor for every court. It lands in a run of third-party and cloud-centric incidents, from the Manchester Airports Group supplier breach to the Azure data tied to Fortune 500 names and OpenAI's own vendor incident report.

If you are a clerk, a lawyer or a litigant with a case in one of the listed courts, do two concrete things now: check whether your court appears on ctracknotification.com (or the Canadian notice) and note the enrollment window for the free credit monitoring before it closes. The US call centre is 1-833-918-5294, engagement number B171847, and anyone with sealed or redacted filings should ask their court directly whether those records fall inside the affected subset.