What was taken
Someone outside Thomson Reuters spent roughly three months inside C-Track, the company's case management platform used by courts across the United States (US) and Canada, before anyone noticed. The files they walked away with included names, Social Security numbers, driver's license numbers, dates of birth, medical information, health insurance details, and in some courts, documents that had been sealed, redacted, or otherwise marked confidential by a judge.
That last category is what sets this breach apart from a routine records leak. Sealed court filings exist because a judge decided the public should not see them, often for reasons tied to a minor, a victim, or an ongoing investigation. Once those files leave a secure system, there is no way to reseal them.
Who is affected
Thomson Reuters has confirmed C-Track customers in 11 US states were affected: Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, Ohio, Pennsylvania, South Carolina, Tennessee, and Wyoming. The US Virgin Islands' Supreme and Superior Courts were also hit. In Canada, three Ontario courts were caught up in the breach: the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice. At least one additional state, Minnesota, has separately confirmed exposure, though it did not appear on Thomson Reuters' original disclosure list, an inconsistency that suggests the company is still working out the full scope.
Thomson Reuters has not said how many individuals were affected, how much data was taken in total, or how the intruder got in. It has also not named a suspect.
The three-month gap, then the two-month wait
The unauthorized access ran from roughly the start of March through June 29, 2026. Thomson Reuters says it discovered the intrusion on June 30. It then took until July 23 to notify affected court administrators, including Montana's court system and Ontario's Ministry of the Attorney General, and until early September to disclose the breach publicly. That is roughly nine weeks between discovery and telling the public, and about six months between the first unauthorized access and public disclosure.
Courts that rely on C-Track for docketing and case tracking were not told their own systems were the problem, because they weren't. Thomson Reuters has been explicit that the intrusion happened inside its own cloud environment, not inside any court's network or infrastructure, and that C-Track kept running throughout without interruption.
What Thomson Reuters is saying and doing
The company says it has found no evidence, so far, that the stolen data has been used for fraud or identity theft. It has brought in outside cybersecurity investigators and law enforcement, and says it has added security measures to C-Track since discovering the incident, though it has not detailed what those measures are.
For US residents, Thomson Reuters is offering 12 months of credit monitoring and identity theft protection through Experian IdentityWorks. Canadian residents are being offered the equivalent through TransUnion's myTrueIdentity service. Affected individuals have been given a dedicated hotline and an enrollment deadline of December 31, 2026, to sign up for the monitoring.
Why it matters beyond the numbers
Court case management systems sit in an unusual position: they hold exactly the kind of sensitive personal data a data broker would want, but the people in that data never chose to be there. A defendant, a juror, a domestic violence petitioner, or a minor named in a sealed juvenile filing has no relationship with Thomson Reuters and no way to opt out of having their information stored in a platform they've likely never heard of. When that platform is breached, the exposure lands on people who had no say in how their data was handled in the first place.
The multi-month detection gap is also a reminder that no operational disruption is not the same as no harm. C-Track staying online for courts the whole time is good news for court operations, but it says nothing about what happened to the data that already left the building.
What this means for you
If you have interacted with a court in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, Ohio, Pennsylvania, South Carolina, Tennessee, Wyoming, the US Virgin Islands, or Ontario in the past few years, whether as a party, witness, or juror, check whether you received a breach notification letter from Thomson Reuters or your local court. If you did, enroll in the free credit monitoring before the December 31, 2026 deadline, and consider placing a freeze on your credit file with the major bureaus regardless of whether you enroll, since a freeze protects against new-account fraud that monitoring only detects after the fact. If sealed or confidential filings tied to you were involved, ask the affected court directly what categories of your data were included, since Thomson Reuters' public disclosure does not break that down.
