Quick Answer
The Thomson Reuters C-Track data breach may have exposed court files containing Social Security numbers, driver’s-license numbers, medical data, and potentially sealed or redacted information. C-Track says it found no evidence of misuse, but affected people should read any notice, enroll in the offered protection, and watch relevant accounts and credit records.
Key Takeaways
- C-Track discovered unauthorized third-party activity in its environment on June 30, 2026.
- The investigation found that certain court files were obtained during March 2026.
- Records from 13 state and territorial court systems may have been involved.
- Affected files could contain Social Security numbers, medical information, and sealed or redacted material.
- C-Track is offering 12 months of complimentary credit monitoring and identity-theft protection.
What happened in the Thomson Reuters C-Track data breach?
The Thomson Reuters C-Track data breach involved unauthorized third-party activity in the C-Track environment, a court-case management and electronic filing platform owned by West Publishing Corporation. C-Track said it discovered the activity on June 30, 2026, and later determined that certain court files had been obtained in March. The timing matters because the discovery date and the period when files were accessed are different, which can affect how courts and individuals assess possible exposure.
C-Track said the investigation did not find evidence of fraud or misuse as of September 2, 2026. The company also said the incident did not disrupt operations or affect systems used to process financial transactions. Those statements reduce the immediate evidence of financial harm, but they do not remove the privacy risk when court files can include long-lived identity information that cannot easily be changed. C-Track’s notice published through the South Carolina Judicial Branch provides the company’s description of the incident and its response.
Thomson Reuters said affected customers had been notified and that its products and services remained operational and safe to use. The company’s operational status does not answer whether a specific person’s information was included in an accessed file. The practical response is to treat an individual notice from a court, C-Track, or Thomson Reuters as the most relevant indicator that personal information may have been involved.
Which court systems may have been affected?
The C-Track incident involved files associated with court systems in 13 jurisdictions: Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, Oregon, South Carolina, Tennessee, New Hampshire, Ohio, Wyoming, and the U.S. Virgin Islands. A court system’s inclusion does not mean every filing, litigant, attorney, witness, or employee in that jurisdiction was affected. The available notices describe certain files, rather than a complete public list of every record obtained.
Ohio identified C-Track as a system hosted by the Supreme Court of Ohio, managed by Thomson Reuters Court Management Solutions, and used by 10 of Ohio’s 12 courts of appeals for filings and related documents. Court filing systems hold documents submitted during appeals and related proceedings, which can include material from parties, lawyers, agencies, and lower-court records. The most sensible approach is to check messages from the applicable court system if you filed, received, or were named in appellate court documents.
Montana said Thomson Reuters notified the state court administrator on July 23 that unauthorized access to Montana C-Track and E-Filing backup data stored on Thomson Reuters servers had occurred from March through June. That detail is important because backup data can preserve copies of files even when the live court platform remains available. The Montana Supreme Court’s release describes the state’s notification timeline and the reported access period.
| Known detail | What the notices say | Why it matters |
|---|---|---|
| Discovery date | C-Track discovered unauthorized activity on June 30, 2026. | The discovery date explains when the company began its investigation. |
| File-access period | Certain court files were obtained in March 2026; Montana described access from March through June. | The period helps affected courts evaluate which records may require review. |
| Affected jurisdictions | 13 state and territorial court systems were identified. | People connected to those courts have a reason to watch for notices. |
| Known misuse | C-Track said it had found no evidence of fraud or misuse as of September 2. | No evidence of misuse is not proof that no future identity fraud will occur. |
What personal information may have been exposed?
The C-Track files may have contained names, Social Security numbers, driver’s-license numbers, medical information, dates of birth, and health-insurance information. C-Track also said some confidential, redacted, or sealed information may have been affected. The most serious risk is the possible exposure of identity and health-related information that can be used for impersonation, account fraud, or highly targeted scams.
Sealed and redacted records deserve particular attention because those labels generally reflect a court’s decision to limit access to sensitive material. A redaction removes selected information from a document available to the public, while a sealed filing restricts access more broadly under court rules or an order. The breach notice does not establish that all sealed or redacted records were accessed, nor does it publicly identify the contents of every affected file.
People who receive a notice should not assume that only conventional financial fraud is relevant. Criminals can use a name, date of birth, court context, or health information to create convincing phishing messages and impersonation attempts. Readers reviewing wider privacy practices can also examine ways browser fingerprinting tracks users, although browser tracking and a court-file breach are separate privacy issues.
Does the C-Track breach mean that identity theft has occurred?
The Thomson Reuters C-Track data breach does not mean that identity theft has occurred for every affected person. C-Track said it found no evidence of fraud or misuse to date, and it said the incident did not affect systems that process financial transactions. That is a meaningful limit on what is publicly known, but stolen personal information can be retained and used later, especially when the data includes Social Security numbers or dates of birth.
Credit monitoring can help identify certain changes in a person’s credit file, such as a newly opened account or a hard inquiry. Credit monitoring does not prevent every form of fraud, and it does not protect against phishing, tax-related impersonation, account takeover, or misuse of medical information. The practical value of the offered service is early warning, not a guarantee that an exposed identity cannot be abused.
People should also be cautious about messages that cite a court case, filing, hearing, or alleged debt. A convincing message may use real details from a legal matter to persuade someone to disclose a password, payment-card number, or verification code. Court staff, financial institutions, and identity-protection services do not need a recipient’s password or one-time authentication code to verify a breach notice.
What should affected people do now?
People who receive a C-Track breach notice should use the official enrollment instructions for the offered 12 months of credit monitoring and identity-theft protection. C-Track listed a U.S. help line at 1-833-918-5294 and the engagement number B171847. Use contact details from an official notice rather than a link or phone number in an unexpected email, text message, or social-media post.
- Read the breach notice carefully and confirm whether it identifies the types of information involved.
- Enroll in the complimentary monitoring service through the official instructions before the stated enrollment deadline, if one is provided.
- Review bank, credit-card, insurance, and credit-account activity for transactions or changes you do not recognize.
- Change passwords for court-related accounts if you reused those passwords elsewhere, then enable multi-factor authentication where available.
- Save the notice, enrollment confirmation, and records of suspicious contacts in case a court, financial institution, or identity-theft service needs them later.
People who find an unfamiliar account, credit inquiry, insurance claim, or tax-related issue should contact the relevant institution promptly and consider reporting identity theft through official government channels. A breach notice alone does not establish that fraud occurred, so avoid paying third parties that promise to “remove” your information from court records or guarantee identity recovery. Users concerned about account protection can also review password and passkey security changes as a reminder to avoid reusing credentials across services.
Why do sealed and redacted court records create additional risk?
Sealed and redacted court records create additional risk because they can contain information that courts intended to restrict, remove from public copies, or shield from broad disclosure. Such material can involve health details, personal identifiers, family matters, confidential business information, or information connected to a legal dispute. The C-Track notice does not identify which categories of sealed or redacted information were affected, so the exact exposure level remains unknown.
The distinction matters because a court docket entry and an underlying filing can contain very different amounts of personal information. A docket may identify a case and procedural event, while attachments, exhibits, and filings can include more detailed records. People who were parties, witnesses, guardians, attorneys, or representatives in cases within the listed court systems have a reasonable basis to monitor official court communications.
Court users should not attempt to republish sealed materials, request copies from unofficial sources, or respond to unsolicited offers involving alleged court documents. The safer action is to contact the court clerk or counsel involved in the matter through independently verified contact information. Court-system breaches also differ from consumer retail incidents, including the privacy concerns discussed in coverage of the Carhartt data breach, because court files may include legal and sensitive personal context beyond account contact information.
What is still unknown about the C-Track incident?
The C-Track notices leave several important questions unanswered. Public statements do not specify the number of individuals affected, the exact number of files obtained, which specific courts had accessed documents, or whether every listed data category appeared in every jurisdiction. Those limits mean readers should avoid assuming either that every C-Track user was affected or that an individual notice reflects only minimal data exposure.
Nevada’s appellate courts said they were responding to a data-security incident involving a third-party vendor. The state-level response illustrates why court systems may issue notices on different schedules and with different details, even when the underlying vendor incident is related. Nevada’s appellate courts statement provides the court system’s own public response.
Thomson Reuters has said affected customers were notified, but the company’s public assurances cannot substitute for a recipient’s review of a specific notice. The practical response is to preserve official communications, enroll in the offered service if eligible, and remain alert for court-themed impersonation attempts. People with questions about a particular sealed case or filing should stop at that point and contact the relevant court or their attorney rather than seeking document details through unofficial channels.
How can court users reduce follow-up scam risks?
C-Track breach recipients can reduce follow-up scam risks by independently verifying every contact that refers to a court case, credit-monitoring enrollment, legal filing, or identity-theft claim. Attackers often exploit public breach disclosures by posing as the affected company, a court clerk, or a credit bureau. The risk is higher when a scammer can reference real legal terminology or personal details from a court matter.
Use a bookmarked court website, a phone number from an official notice, or a number published by the court itself before discussing a case. Do not open attachments that claim to contain replacement court filings unless you expected the document and can verify the sender. A legitimate institution may ask for identity verification through its established portal, but it will not need your password, banking PIN, or multi-factor authentication code.
People using connected services should also review account access and avoid granting unnecessary permissions to unfamiliar apps. Security incidents affecting sensitive systems have also prompted urgent patching guidance for products such as critical UniFi security flaws, but the appropriate action in the C-Track case is account vigilance and official communication rather than attempting technical remediation on a court platform.
FAQ
What is the Thomson Reuters C-Track data breach?
The Thomson Reuters C-Track data breach involves unauthorized third-party activity that led to certain court files being obtained in 2026. C-Track said it discovered the activity on June 30 and later began notifying affected customers.
Which states were affected by the C-Track breach?
The C-Track incident involved court systems in 13 jurisdictions, including Alabama, Ohio, Montana, Nevada, Pennsylvania, South Carolina, and the U.S. Virgin Islands. A jurisdiction’s inclusion does not mean every court record or resident in that location was affected.
Did the C-Track breach expose Social Security numbers?
Yes, C-Track said some affected records could contain Social Security numbers. The company also identified driver’s-license numbers, dates of birth, medical information, and health-insurance information as possible data types.
Is Thomson Reuters offering credit monitoring after the C-Track breach?
Yes, C-Track is offering 12 months of complimentary credit monitoring and identity-theft protection. C-Track listed 1-833-918-5294 as its U.S. help line and B171847 as the engagement number.
Has fraud been linked to the C-Track breach?
No, C-Track said it had found no evidence of fraud or misuse as of September 2, 2026. People who receive a notice should still monitor relevant accounts because exposed identity information can be misused after a delay.