Your court file leaked, and the court was not the one breached

C-Track is case management software sold to courts by West Publishing, a Thomson Reuters company. An unauthorised party got into files belonging to it starting in March 2026; the company says it detected the activity on 30 June, told the affected courts through late July, and disclosed publicly on 2 and 3 September 2026. The disclosure landed in pieces rather than all at once, which is why the story looked like it was growing: Minnesota’s Judicial Branch and Oregon’s Judicial Department published their own statements on 2 September, the Supreme Court of Ohio described a wider scope than the others, courts in Wyoming and New Hampshire followed, and reporting from The Hacker News, Help Net Security and Infosecurity Magazine pulled the pieces into one incident. Depending on whether you count Oregon and Minnesota, which confirmed through their own courts rather than through the vendor’s notice, the published tally runs from eleven states to thirteen, plus the US Virgin Islands and three courts in Ontario.

Not customers. There is no signup here, no account and no terms anyone agreed to, which is what makes this different from the breaches people are used to reading about. The population is everyone a case touched: parties to an appeal, the people they sued or were sued by, witnesses, minors in custody and family matters, victims named in criminal appeals, guarantors, medical providers, and relatives who appear in a filing for a single paragraph. Most of them never chose to be in a court record and many will not remember the case. It also means the usual reflex — check whether you have an account there, change the password — has nothing to work with, because you never had a relationship with the vendor that lost the data.

More than most people expect, because courts collect identifiers to keep two people with the same name apart and to enforce judgments. The vendor’s notice says affected records may contain names along with one or more of Social Security numbers, driver’s licence numbers, dates of birth, medical information and health insurance information. Coverage of the individual court notices adds case numbers, party addresses, phone numbers, charge descriptions and docket entries. Put that beside the kind of case that reaches an appellate court and the shape of the exposure becomes clear: a custody appeal carries children’s details, a personal-injury appeal carries medical history, a benefits appeal carries a Social Security number by definition. None of those can be reissued the way a bank reissues a card.

The vendor’s notice says confidential, redacted or sealed court information may have been affected at certain courts. That sentence is doing a lot of work and it is hedged for a reason: the company has not said which courts or which files, and it may not be able to. Two courts, Montana and Minnesota, have said case documents were not part of what was accessed in their instances, and Minnesota described the exposure as backup material handed over for technical support. Ohio is the counterweight, describing access to its live production platform. If you are reading this because a judge sealed something to keep an address or a child’s name out of public view, that variation is not academic. The route to an answer is the clerk of the court that granted the order, not the vendor and not a headline; ask whether your case sat in the affected data and what the court is doing about protective orders it granted.

Five things, roughly in this order. Freeze your credit at Equifax, Experian and TransUnion — free, reversible, and the only step that stops an account being opened rather than reporting it later. Request an IRS Identity Protection PIN if a Social Security number could be in your file. Call the clerk of the court that handled your case and ask two questions: whether that court used C-Track, and whether anything sealed or confidential in your matter was within the affected data. Watch for a letter from West Publishing rather than from the court, and enrol in the monitoring it offers if it reaches you — reporting puts the enrolment deadline at 31 December 2026. And pull your reports at annualcreditreport.com now rather than waiting for an alert, since the files were taken in March and the notices only went out in September.

People who have been through a court case are unusually easy to reach with official-looking mail, and this breach hands over exactly the details that make a fake convincing: a case number, a court, a charge description, an address. Expect three things. A message offering to enrol you in the free monitoring if you confirm your Social Security number, which is backwards and is the giveaway. A notice about an unpaid fine, a missed appearance or jury duty, which is an old scam with fresh material behind it. And, later, settlement emails with a claim number. The test that works on all three is to stop using the contact details in the message and call the court or the number printed on the letter you can verify independently. Our guide to reading a breach notice covers how a genuine one is put together.

Court records were never private, and that is the thing this breach makes worse rather than starts. Names, addresses, case types and relatives are pulled out of public court and property records by people-search sites and sold as profiles, which is why typing your own name into a search engine after a court case is such an unpleasant experience. Nothing about the C-Track incident changes what those sites already publish, and it does change how useful it is to someone holding a stolen file: an identifier is only worth as much as the current address and family names you can attach to it. Getting those listings removed is the one step here whose effect outlasts the news cycle, and it needs re-checking rather than doing once, because the sites relist from the same public sources the next time they refresh. The shorter version of everything else is in our post-breach guide.