Thomson Reuters breach exposes US and Canadian court records

Thomson Reuters has disclosed a data breach at C-Track, the court case-management system run by its West Publishing Corporation unit, after an unauthorized party obtained files from the vendor's cloud. The official notice, dated 2 September 2026, says the incident happened in C-Track's cloud environment, not on the courts' own networks. West Publishing describes a subset of records that may have been affected and says the investigation is still ongoing.

West Publishing says it detected unauthorized third-party activity on 30 June 2026. Its investigation later found the access had actually happened in March 2026, when an unauthorized party obtained certain C-Track files, a gap of roughly three months between intrusion and discovery.

The notice lists appellate and other courts across a wide spread of US jurisdictions, including Alabama, several Pennsylvania courts, Kentucky, Montana, Nevada, North Dakota, Oregon, South Carolina, Tennessee, New Hampshire, multiple Ohio districts, the US Virgin Islands and Wyoming, with the full roster on the notice itself. North Dakota's court system reproduced the vendor notice in full, and in Canada, Ontario courts were notified through a separate release.

For a subset of records, the possible data includes names together with one or more of Social Security numbers, driver's licence numbers, medical information, dates of birth and health insurance details. West Publishing says some confidential, redacted or sealed information may have been impacted for certain courts.

South Carolina's Judicial Branch, in a statement carrying West Publishing's release, said its preliminary review suggests the affected data is backup information for appellate cases from 2020 and earlier, and that it has not confirmed any personal information in its own subset was exposed. South Carolina's early read does not apply to every court on the list.

West Publishing says it found no evidence that financial-transaction systems were involved and no evidence of fraud or misuse so far. C-Track remains operational, additional security measures have been added, and affected people are being offered 12 months of credit monitoring. The US call centre on the notice is 1-833-918-5294, engagement number B171847. The Record and Help Net Security covered the disclosure.

Who carried out the intrusion, exactly how they got in, and how many records were taken are not public, and the scope is still under review. Some state statements are already narrower than the vendor's list of possible data types, so the ceiling in the notice is not the confirmed floor for every court. The path is a vendor cloud, the same third-party pattern as the Manchester Airports Group supplier breach.

Some offers on this page may be paid placements or contain affiliate links.