What happened in the cybersecurity incident involving Thomson Reuters’ C Track case management platform—including when and where unauthorized access was detected, which U.S. states, the U.S. Virgin Islands, and Canadian courts were affected, what types of files and personal infor

Thomson Reuters’ C-Track platform was accessed by an unauthorized third party in March 2026; C-Track detected the activity on June 30 and said the incident was contained and investigated with outside cybersecurity experts and law enforcement. 1

Scope and potentially exposed information

• The affected U.S. court systems were in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, New Hampshire, Ohio, and Wyoming, plus the U.S. Virgin Islands. 1
  • Specifically: Alabama Appellate Courts; Pennsylvania’s Environmental Hearing Board (a former client), Monroe and Washington County Courts of Common Pleas, and Fifth Judicial District; Kentucky, Montana, Nevada, North Dakota, Tennessee, and New Hampshire appellate/supreme-court systems; South Carolina’s Supreme Court and Court of Appeals; Ohio appellate districts 1–7, 9, 11, and 12; the U.S. Virgin Islands Supreme and Superior Courts; and the Wyoming Judicial Branch. 1
• In Canada, the affected systems were the Court of Appeal for Ontario, Ontario Superior Court of Justice, and Ontario Court of Justice. 1
• The intruder obtained certain C-Track court files—a subset of court records—and some may have contained names, Social Security numbers, driver’s-license numbers, dates of birth, medical or health-insurance information. Confidential, redacted, or sealed material may also have been included for some courts. 1
• The company said the incident was not caused by the courts’ own networks or systems, and it found no evidence that systems processing financial transactions were affected. 1

Response and operational impact

• C-Track said it immediately contained the activity, secured its environment, implemented additional security measures, and notified affected court customers. 1
• Ontario’s three chief justices said they were working with C-Track/Thomson Reuters and relevant justice-sector partners to investigate, assess the effect on court information, and communicate with affected people. 1
• Court operations continued, and Thomson Reuters said C-Track services were not disrupted. 1

What was still unknown

• At the time of disclosure, neither the identity, motive, nor affiliation of the attacker had been publicly identified. 1
• The precise number of people affected, the complete inventory of files accessed, and whether every potentially sensitive field was actually viewed or taken were not publicly established. 1
• C-Track reported no evidence at that point of fraud or misuse of the information. 1

Assistance and contact channels

• For U.S.-affected individuals, C-Track planned to offer 12 months of Experian IdentityWorks credit monitoring and identity-theft restoration support, including access to an incident call center at 1-833-918-5294 (weekdays, 8 a.m.–8 p.m. Central; TTY via 711; engagement number B171847). 1
• For Canadian-affected individuals, C-Track Canada planned to provide a 12-month no-cost TransUnion myTrueIdentity membership, including credit monitoring, identity-restoration help, dark-web monitoring, and eligible expense-reimbursement insurance; questions could be directed to 1-833-918-4543 (weekdays, 8 a.m.–8 p.m. Eastern). 1
• Affected people and court customers were also directed to C-Track’s dedicated incident-notification websites and their court or C-Track contacts for case-specific information. 1