Thomson Reuters Says Court Records Software Breached, 11 States Affected
West Publishing's C-Track platform, used by courts across the U.S. and beyond, had files taken by an unauthorized party in March. Thomson Reuters only spotted the activity three months later.
Key points
- Thomson Reuters disclosed on Wednesday that an unauthorized party took files from C-Track, a court case management platform sold by its West Publishing Corporation unit.
- The intrusion happened in March 2026 and was discovered by West Publishing on June 30, 2026, a gap of roughly three months.
- Courts in 11 U.S. States, the U.S. Virgin Islands, and Ontario, Canada relied on the affected software.
- A subset of the court records taken may contain the names of individuals.
- The disclosure will draw scrutiny under state breach notification laws and, for any listed-company reporting, the SEC's cybersecurity disclosure rule on material incident reporting.
Thomson Reuters has told regulators and customers that hackers broke into C-Track, a piece of software courts use to manage case files, and copied documents out. West Publishing Corporation, the unit that sells the platform, says it only detected the activity on June 30, 2026, roughly three months after the intrusion in March. That detection gap is exactly the kind of detail state attorneys general focus on when they review a breach.
Courts in 11 U.S. States, the U.S. Virgin Islands, and the Canadian province of Ontario used the affected system. A subset of the files taken may include the names of individuals. Thomson Reuters hasn't said in its public statement whether Social Security numbers or sealed records were among the exposed documents, though the possibility was raised in earlier reporting by The Hacker News.
What actually happened?
Someone got into C-Track without permission and pulled files out. C-Track is the tool clerks and judges use to track case dockets and filings. If you've ever been to court, some record of you likely sits in a system like this.
Thomson Reuters hasn't named a group, a method of entry, or a ransom demand. The company describes the event as unauthorized access to files, not ransomware, which is malicious software that locks a victim's data until they pay.
Which courts were affected?
Courts in 11 U.S. States, the U.S. Virgin Islands, and Ontario, Canada. Thomson Reuters hasn't published the full list of jurisdictions in the statement reviewed for this piece. Notifications to individual court administrators are expected to identify specific courts.
| Fact | Detail |
|---|---|
| Platform | C-Track case management software |
| Operator | West Publishing Corporation (Thomson Reuters unit) |
| Intrusion date | March 2026 |
| Discovery date | June 30, 2026 |
| Jurisdictions | 11 U.S. States, U.S. Virgin Islands, Ontario |
| Data at risk | Court records, may include names |
What are the regulatory stakes?
Several. Each U.S. State has its own breach notification statute with its own clock, and Ontario's Personal Information Protection and Electronic Documents Act requires notice of breaches posing a real risk of significant harm.
For Thomson Reuters itself, listed in Toronto and New York, the SEC's cybersecurity disclosure rule requires registrants to report material cybersecurity incidents on Form 8-K within four business days of a materiality determination. Whether the C-Track incident clears that bar is a judgment the company has to make and, if challenged, defend. We covered the SEC rule's disclosure mechanics in our Hasbro notification story on 28 August, where the same multi-state filing question arose.
Courts and clerks are themselves subject to state records laws. Any sealed material caught in the files raises a separate set of duties owed to litigants, and that's the part of this breach worth watching most closely.
What should ordinary people do?
If you've had a case in one of the affected courts, watch for a written notice from the court or from Thomson Reuters. Don't rely on email alone: notification laws generally require postal mail for sensitive data.
Be wary of phone calls or emails claiming to be from a court and asking you to confirm personal details. Real court staff won't ask for a Social Security number by email. If in doubt, call the clerk's office using a number from the court's own website.
