Thomson Reuters Discloses Data Breach Exposing Court Records Across US and Canada
Global media and technology company Thomson Reuters revealed a major data breach involving its C-Track court case management platform, affecting judicial systems across at least 12 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. According to public disclosures made in early September 2026, unauthorized actors accessed C-Track cloud files between March and June 2026, though the intrusion was first detected on June 30.
The C-Track platform is used by supreme, appellate, and county courts to manage case filings, schedules, and confidential legal documents. An ongoing investigation conducted by third-party cybersecurity experts revealed that the exfiltrated records included personal identifiable information such as individuals' full names, Social Security numbers, dates of birth, driver's license numbers, medical data, and health insurance details. In several jurisdictions, confidential, redacted, or sealed court records were also compromised. Affected U.S. states include Alabama, Kentucky, Minnesota, Montana, Nevada, New Hampshire, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, and Tennessee.
Thomson Reuters confirmed that the breach was contained within its cloud environment and did not disrupt court operations or compromise the internal networks of participating judicial bodies. The company is offering 12 months of free credit monitoring and identity protection services to impacted individuals in the U.S. and Canada. Judicial leadership in multiple states and Ontario have expressed serious concern regarding third-party vendor risks and are working alongside government cybersecurity divisions to assess the full scale of the data exposure.
