Technology Miraj Islam October 8, 2026 0 Comments

Arizona court system hack leads to theft of personal data of 1.3 million Americans

Successful phishing attack on Arizona Supreme Court compromised data
More than a million people are now believed to be affected
Court operations were not interrupted

The Arizona Supreme Court has suffered a cyberattack in which it lost sensitive data of more than one million people after an employee allegedly “clicked on a malicious link in an email,” leading to the compromised information of 1.3 million people.

Information is still scarce on the topic, as we don’t know if that malicious link resulted in the victim’s device being infected with a data thief, or if they were asked to log in to a fake portal, allowing threat actors to access their account directly.

Threat actors were confirmed to have copied information from 1.3 million people with unpaid court fees, fines, and restitution payments for criminal and traffic violations dating back 30 years. They also obtained nearly 30,000 active and inactive protective orders, as well as 150,000 reports dating back to 2010 from a foster care board that made recommendations in cases where parents were allegedly unable or unfit to care for a child.

Responding to the attack

According to the Associated Press (AP), the court’s IT team shut down the attack on a backup server approximately two hours after it was detected on September 24. Since then, they have been notifying affected people about the breach and theft.

So far, it appears the data has not yet reached the dark web: “We have no evidence that it was used or shared” after the attack, said Supreme Court spokesman Alberto Rodríguez.

This would also suggest that this was not the work of any known ransomware groups or data extortionists because by now they would have at least bragged about it on the dark web.

The investigation is still ongoing. Court operations have not been disrupted in any way, Rodríguez added. The records were not altered or deleted, and the attackers apparently did not steal information about jurors, witnesses or court employees.

Attack the courts

Courts (both in the United States and elsewhere) are frequent targets, primarily due to the sensitivity of the information they deal with.

In early September 2026, it was reported that Thomson Reuters, the IT company behind the Reuters news agency, suffered a similar incident in March.

The company operates a court case management system called C-Track, used by different courts to manage cases, filings, hearings and schedules. It is used by courts in several US states, the US Virgin Islands, and Ontario, Canada. Anonymous bad actors managed to break in and obtain “court records and personal information” in 11 US states, the US Virgin Islands, and Ontario, Canada.

Even earlier, on November 21, 2025, the Georgia Superior Court Clerks Cooperative Authority (GSCCCA), which manages court and public records services throughout Georgia, detected hackers attempting to break into the network. The attack was claimed by threat actors called Devman, who claimed to have stolen sensitive files and demanded a ransom payment in return. The GSCCCA temporarily closed its websites and online services while the FBI warned the authority of an imminent threat.

However, GSCCCA said it stopped the attackers before they could extract or encrypt data and refused to pay the ransom. Devman is not a well-known name in the cybercriminal underworld and is apparently a financially motivated, not state-sponsored, group.

Through AP News