Thomson Reuters court software breach may expose personal data across multiple jurisdictions

Thomson Reuters has disclosed that an unauthorised party accessed files from C-Track, its court case management platform, between March and June 2026. The breach affected courts in 11 US states, the US Virgin Islands and Ontario, Canada, and may have exposed names, Social Security numbers, driver’s licence numbers, dates of birth, medical information and health insurance details.

West Publishing, the Thomson Reuters unit behind C-Track, said it discovered the activity on June 30 and began notifying courts in late July. Public notices followed on September 2. The company is offering affected individuals 12 months of credit monitoring through Experian in the US and TransUnion in Canada.

Several courts said the accessed data was backup or historical information stored on Thomson Reuters servers, though Ohio’s Supreme Court said the unauthorised access took place on its production platform. Minnesota has terminated Thomson Reuters’ access to its court environments, and North Dakota said there is an active criminal investigation. Thomson Reuters said there has been no operational disruption to C-Track and considers the platform safe to use.