What Happened in the Thomson Reuters C-Track Cybersecurity Incident?

Thomson Reuters disclosed a cybersecurity incident involving C-Track, its court case-management platform. The company said an unauthorized third party obtained certain C-Track files in March 2026 and that it detected the activity on June 30, 2026. The incident reached court customers in the United States, the U.S. Virgin Islands and Ontario, Canada. 1

What was accessed—and what was not yet known

The company said the intruder obtained a subset of C-Track court files. Depending on the court and file, those records may have contained names and sensitive personal information, including Social Security numbers, driver’s-license numbers, dates of birth, medical information and health-insurance information. Some affected materials may also have included confidential, redacted or sealed records. 1

The disclosure did not establish how many people were affected, provide a complete file-by-file inventory, or confirm that every potentially sensitive data field was viewed or taken. The identity, motive and affiliation of the attacker had not been publicly identified at the time of disclosure, and C-Track reported no evidence then of fraud or misuse of the information. 1

Which courts and jurisdictions were affected

The affected U.S. court systems were in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, New Hampshire, Ohio and Wyoming, as well as the U.S. Virgin Islands. 1

Reportedly affected systems included:

• Alabama Appellate Courts
• Pennsylvania’s Environmental Hearing Board, Monroe and Washington County Courts of Common Pleas, and Fifth Judicial District
• Kentucky, Montana, Nevada, North Dakota, Tennessee and New Hampshire appellate or supreme-court systems
• South Carolina’s Supreme Court and Court of Appeals
• Ohio appellate districts 1–7, 9, 11 and 12
• U.S. Virgin Islands Supreme and Superior Courts
• Wyoming Judicial Branch 1

In Canada, the affected courts were the Court of Appeal for Ontario, Ontario Superior Court of Justice and Ontario Court of Justice. Ontario’s three chief justices publicly acknowledged the incident and said they were working with Thomson Reuters/C-Track and justice-sector partners to investigate the effect on court information and communicate with affected people. 1

Response and operational impact

C-Track said it contained the unauthorized activity, secured the affected environment, added security measures and notified affected court customers. It said the incident was not caused by the courts’ own systems or networks, and that it found no evidence that systems handling financial transactions were affected. 1

Importantly for court users, operations continued and Thomson Reuters said C-Track services were not disrupted. That does not resolve the privacy questions around the files, but it distinguishes the incident from an outage of court services. 1

Support offered to potentially affected people

For people affected through U.S. court customers, C-Track said it planned to provide 12 months of Experian IdentityWorks credit monitoring and identity-theft restoration support. The incident call center was listed as 1-833-918-5294, available weekdays from 8 a.m. to 8 p.m. Central time; TTY users could call 711. 1

For Canadian-affected individuals, C-Track Canada said it planned to offer 12 months of no-cost TransUnion myTrueIdentity membership, including credit monitoring, identity-restoration assistance, dark-web monitoring and eligible expense-reimbursement insurance. The listed contact number was 1-833-918-4543, weekdays from 8 a.m. to 8 p.m. Eastern time. 1

People who may be affected should use the incident-notification information provided by their court or C-Track, since eligibility and the records involved can vary by jurisdiction. The central unresolved issue remains the same: public disclosures confirmed that some court files were obtained, but not the complete set of files or individuals affected. 1