C-Track Data Breach Affected Court Records in the U.S. and Ontario
An incident involving Thomson Reuters’ C-Track system may have exposed sensitive court-record data in 12 U.S. states, the U.S. Virgin Islands and Ontario.
The C-Track data breach, involving the court system owned by Thomson Reuters subsidiary West Publishing Corporation, affected court records in 12 U.S. states, the U.S. Virgin Islands and several courts in Ontario. The vendor discovered unauthorized activity in its environment on June 30, 2026. A subsequent investigation showed that an unauthorized party had obtained certain C-Track files as early as March.
The scope of the incident is not yet publicly known. It has not been confirmed how many people are affected, which specific files were obtained from individual courts or whether the data was later disclosed or misused.
The C-Track data breach may have involved sensitive information
According to notices from C-Track and affected courts, the records may have included names, Social Security numbers, driver’s license numbers, dates of birth, medical information or health insurance information. At some courts, confidential, redacted or sealed information may also have been present in the affected materials.
The nature of court files makes the incident particularly sensitive. Such documents can link identifying information with details about medical conditions, family circumstances or other personal matters. However, it has not been confirmed which sealed or otherwise sensitive documents were exposed.
The breach did not involve court networks
Thomson Reuters and C-Track state that the incident did not result from a compromise of the affected courts’ networks. The unauthorized activity involved the C-Track vendor environment. According to the company, service operations were not interrupted, and there is no evidence that financial transaction systems were affected.
The company also said it has no evidence so far that the obtained data was misused. That does not mean the precise impact has been finalized: the forensic investigation is ongoing, and the extent of the data compromise is still being assessed.
The vendor is offering credit monitoring
C-Track implemented additional security measures and engaged external experts and law enforcement. It is offering potentially affected individuals 12 months of credit monitoring and identity theft protection.
The method of intrusion, the attacker’s identity and the volume of data obtained are not known. It has also not been publicly confirmed whether the attacker obtained entire court files or only portions of documents.
What happens next
Further information should come through direct notices to people the vendor determines may be potentially affected. Clarifying the scope for individual jurisdictions will also be important, particularly regarding sealed documents and sensitive categories of data.
The technical method of compromise, attribution of the attack and any evidence of further handling of the data will remain subjects of the ongoing investigation. Possible actions by U.S. and Canadian courts or regulators against Thomson Reuters and West Publishing also remain open questions.
Sources
- C-Track Canada – The vendor’s initial notice confirms the discovery of activity on June 30, the acquisition of files in March, the affected Ontario courts, the ongoing investigation and the absence of evidence of misuse.
- Ontario Courts – A joint statement from Ontario’s three chief justices confirms the impact on Ontario court data, the uncertain scope and the ongoing assessment of effects.
- South Carolina Judicial Branch – The official statement includes C-Track’s notice listing the affected U.S. courts, possible data categories, operational status and mitigations.
- The Record – Independently summarizes the incident’s scope, including at least 12 U.S. states, the U.S. Virgin Islands and Canada.
Verified and updated: 09/03/2026 15:21
