Arizona Court System Hit by Cyberattack, Potentially Exposing Sensitive Personal Data
Arizona’s Supreme Court has confirmed that the state’s court system was targeted in a cyberattack, warning that hackers may have copied personally identifiable information belonging to a large number of Arizona residents.
The incident, disclosed by the Arizona Supreme Court on Friday, has raised concerns over the potential exposure of highly sensitive information contained within court records. Authorities have begun notifying individuals whose data may have been compromised, although they have not disclosed which specific courts or databases were affected.
Officials said they are withholding additional technical details while the investigation remains ongoing, citing concerns that further information could interfere with the inquiry or increase risks to affected individuals.
Court data potentially copied by attackers
According to notifications sent by the Administrative Office of the Courts (AOC), the attack occurred within the previous 36 hours and involved criminal hackers or automated systems targeting Arizona’s court infrastructure.
The Supreme Court said there is currently no evidence that the stolen information has been distributed or otherwise shared. Officials also cautioned that the format in which some of the data was copied may make it difficult to read or interpret.
Nevertheless, the nature of court records makes the incident particularly concerning. Judicial databases can contain names, contact information, case details, and other sensitive personal information.
Chief Justice Timmer said the court immediately began coordinating a response after learning about the incident and contacted the FBI’s senior leadership in Arizona.
The court said it is working with investigators and taking steps to reduce the potential impact on people whose information may have been affected.
Protective-order recipients among those notified
The potential exposure is especially concerning for people whose information was protected by court-issued protective orders.
According to local reporting, some individuals who currently have, or previously had, protective orders were among those notified about the incident. Protective orders are commonly issued in cases involving domestic violence, harassment, abuse, or threats, and may involve confidential addresses or other location information.
For people relying on those protections, the possibility that sensitive location data could have been copied represents a significant concern.
One affected woman told AZFamily that learning her personal and location information may have been accessed left her feeling vulnerable. She said protecting that information was one of the reasons she had a protective order in the first place.
At this stage, however, authorities have not confirmed whether addresses or other specific information contained in protective-order records were actually accessed.
Scope of the breach remains unclear
The Arizona Supreme Court has not yet disclosed how many people may have been affected, which court systems were targeted, or which databases were accessed.
That lack of detail makes it difficult to determine the full scope of the incident.
The court has emphasized that its investigation is ongoing and that additional information will be provided to affected individuals as it becomes available.
The incident also comes amid growing scrutiny of the cybersecurity of judicial systems in the United States.
Earlier this year, a cybersecurity incident involving Thomson Reuters’ C-Track case-management platform affected court systems across multiple US states, the US Virgin Islands, and Canada. An investigation into that incident found that some affected court records contained names and other personal information.
A growing cybersecurity challenge for courts
Court systems hold some of the most sensitive information managed by public institutions, making them an increasingly important target for cybercriminals.
Unlike conventional corporate breaches, attacks against judicial infrastructure can potentially expose information connected to criminal cases, family disputes, protective orders, financial matters, and other highly sensitive proceedings.
The Arizona incident also highlights the challenge authorities face when responding to attacks against systems containing information about vulnerable individuals. Even when there is no evidence that stolen data has been publicly released, the possibility that it was copied can create significant uncertainty for those affected.
For now, Arizona officials say there is no evidence that the compromised information has been shared further. Investigators are continuing to determine how the attackers gained access, what information was copied, and how many individuals may ultimately be affected.
Until those questions are answered, the full impact of the attack remains unknown.