Thomson Reuters Confirms Court Data Breach

Thomson Reuters has confirmed a cybersecurity incident involving its CTrack court case management software, resulting in unauthorized access to sensitive court records and personal information. The breach, which occurred within Thomson Reuters' own systems, affected courts in at least 11 U.S. states, the U.S. Virgin Islands, and Canada. The company detected unauthorized activity on June 30, 2026, initiating an investigation with external cybersecurity experts and law enforcement. This probe determined that an unauthorized party had obtained certain CTrack files in March 2026. Investigations suggest the intrusion and access to files may have persisted over a multi-month period, from March through June 2026. The compromised data may include individuals' names, Social Security numbers, driver license numbers, dates of birth, medical information, and health insurance details. In some jurisdictions, confidential, redacted, or sealed court records could also have been accessed. However, Thomson Reuters stated there is no evidence to date of fraud or misuse of the accessed information.