Thomson Reuters Court Software Breach Exposed SSNs

Thomson Reuters disclosed on Wednesday, July 3, 2026, that an unauthorized party gained access to files from C-Track, a court case management platform developed by its West Publishing Corporation subsidiary. The breach, which occurred in March 2026, impacted courts across 11 U.S. states, the U.S. Virgin Islands, and the Canadian province of Ontario. West Publishing Corporation, the unit responsible for C-Track, first detected the unauthorized activity on June 30, 2026. The company stated that a subset of the compromised court records may contain individuals' names, Social Security Numbers (SSNs), and other sensitive personal information. The full extent of the data exposed is still under investigation, but the potential for SSN exposure raises significant concerns about identity theft and fraud for affected individuals. C-Track is a proprietary software solution designed to manage legal cases and court proceedings, providing functionalities for docketing, scheduling, and case tracking. Its use by multiple judicial systems underscores the widespread potential impact of this security incident. Thomson Reuters has initiated an investigation into the breach and is working with cybersecurity experts to understand the scope and nature of the unauthorized access. The company has also begun notifying affected courts and individuals, offering guidance on protective measures. This incident highlights ongoing cybersecurity challenges within the legal and governmental sectors, where sensitive data is routinely handled. The breach of C-Track follows a series of high-profile data compromises affecting various industries, emphasizing the persistent threat posed by sophisticated cyber actors. West Publishing Corporation, a long-standing provider of legal information and technology, serves a broad range of legal professionals and institutions. The company's C-Track platform is utilized by numerous court systems to streamline judicial operations and manage case dockets efficiently. The compromise of such a critical system raises questions about the security protocols in place and the potential vulnerabilities within software used by governmental entities. The investigation is expected to determine the specific types of data accessed, the duration of the unauthorized access, and the methods employed by the attackers. Thomson Reuters has committed to providing further updates as the investigation progresses and has stated its intention to enhance security measures to prevent future incidents. The affected jurisdictions include states such as California, Texas, and New York, among others, as well as the U.S. Virgin Islands and Ontario, Canada, indicating a broad geographical reach of the breach. The company's response includes offering credit monitoring services to individuals whose SSNs may have been compromised, a standard practice in mitigating the fallout from such data exposures. The incident serves as a stark reminder of the critical importance of robust cybersecurity defenses for organizations handling sensitive personal and legal information.