Thomson Reuters says an unauthorized party accessed files in its C-Track court case management platform, with records viewed by appellate courts in multiple U.S. jurisdictions and in Ontario, Canada. The company reports it detected the cloud-environment activity on 30 June and later disclosed the incident publicly.
The affected data is described as court records processed through appellate courts, with some reporting noting the potential exposure of sensitive information such as personal data, and in at least one account, possible Social Security numbers and sealed records. Outlets differ slightly on details including the number of states named (reported as 11 or 12), the locations included (some mention the U.S. Virgin Islands), and the timing of when the access may have occurred, including references to March 2026 for when certain files were taken.
Overall, all reports attribute the intrusion to the same Thomson Reuters C-Track product and cite the company’s determination that it involved unauthorized access to files held within its cloud environment used by judicial customers. Thomson Reuters provides separate notification channels for affected parties in the United States and Canada.
