Thomson Reuters has disclosed a cybersecurity incident impacting its court management software, which has resulted in a breach of sensitive case data across Canada and the US.
The company detected activity affecting information held in its C-Track product, a digital case management system, on June 30.
A subsequent investigation discovered that an unauthorized party obtained certain C-Track Canada files associated with three Ontario courts - the Court of Appeal for Ontario, the Ontario Superior Court of Justice and the Ontario Court of Justice.
“Based on the investigation, a subset of court records were affected, some of which could potentially contain individuals’ names and personal information. Certain confidential, redacted or sealed information may have been impacted for certain affected courts,” Thomson Reuters wrote in a statement released on September 2.
The data breach was also confirmed in a public statement by Ontario's three Chief Justices, who warned it is possible that personal information relating to individuals involved in court proceedings or mentioned in court documents may have been exposed.
Alongside the Ontario courts, the C-Track incident has also impacted appellate courts in 11 US states and the US Virgin Islands, West Publishing Corporation, a US-based provider of court management solutions owned by Thomson Reuters, revealed in a separate statement.
These states are South Carolina, Nevada, New Hampshire, North Dakota, Ohio, Kentucky, Pennsylvania, Alabama, Montana, Tennessee and North Dakota.
West Publishing said the affected court records potentially contain individuals’ personal records, including names, Social Security numbers, driver’s license numbers, medical information, dates of birth and health insurance information.
Like with the Ontario courts, certain confidential, redacted or sealed information may have been impacted for certain affected courts.
The investigation is ongoing to establish the specific content and types of information breached at each affected court, as well as the number of individuals whose information may have been impacted.
Thomson Reuters said there is no evidence that systems used to process financial transactions were impacted by the incident.
No details have been provided on how the C-Track records were accessed. However, Thomson Reuters emphasized that the incident was not caused by the courts' networks, systems or data security.
There’s no evidence that the affected data has been misused for fraud or other purposes to date.
Court Records in High Demand
Court documents are known to be a target for a range of threat actors, including nation-state groups for espionage purposes, malicious actors attempting to disrupt or influence individual cases, and financially motivated cybercriminals using sensitive court data to extort individuals and organizations.
In August 2025, the US federal judiciary announced stronger cybersecurity protections for sensitive court documents following “recent escalated cyber-attacks” on its case management system.
The statement followed reports that the federal case filing system was breached by threat actors, exposing sensitive court documents in multiple US states.