A breach notice filed this week traces back to March 2026 — six months before anyone outside a small circle of court IT staff knew about it. West Publishing Corporation, the Thomson Reuters subsidiary that runs the C-Track court case management platform, has confirmed that an unauthorized party obtained files containing Social Security numbers, driver’s license numbers, medical records and, in some jurisdictions, sealed or redacted court filings that were never meant to be public in the first place.
What C-Track is, and why courts trust it with this much
C-Track is case management software: the system appellate and trial courts use to track filings, dockets and case records, including material a judge has ordered sealed from public view. According to The Record’s reporting, appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee and Wyoming, along with courts in Pennsylvania, ten of Ohio’s twelve appellate districts, the U.S. Virgin Islands and three courts in Ontario, Canada, all license the platform. Oregon’s Judicial Department confirmed its own appellate courts were affected shortly after the initial announcement, and The Hacker News’s count adds Minnesota to the list — bringing the confirmed total to at least 13 jurisdictions and illustrating how a vendor disclosure like this one tends to grow in the days after the initial notice, as individual courts confirm their own inclusion rather than all being named at once.
Because the platform is shared infrastructure — one vendor’s system used by courts across state and national lines — a single compromise of West Publishing’s environment becomes, at a stroke, a multi-state, multi-country disclosure. No individual court’s own network was breached; the exposure happened entirely upstream, in the vendor everyone plugged into.
Six months from access to disclosure
West Publishing’s own account of the timeline, as reported by both outlets, is that unauthorized access to the C-Track environment ran from 1 March through 29 June 2026 — nearly four months — before the company detected it on 30 June. Courts began receiving notification between 23 and 27 July, close to a month after discovery. Public disclosure followed on 2 September, roughly six weeks after courts were told and more than five months after the access began. Montana’s court system said the 2 September date was chosen specifically so that the vendor and the various affected states could issue their public notices simultaneously, rather than have the story break piecemeal state by state.
West Publishing has been explicit that the compromise sat entirely in its own infrastructure. Thomson Reuters said, as quoted by Help Net Security, that the incident “occurred within its environment and was not caused by the networks, systems or data security of the affected courts,” and that “there has been no operational disruption to C-Track as a result of this incident.” The company has not disclosed how the attacker got in, how much data was taken in total, or who was responsible. West Publishing’s public statement says there is “no evidence to date of fraud or misuse of the information.” North Dakota’s court system has separately confirmed an active criminal investigation into the incident.
A vendor breach, not a courthouse breach
It’s worth being precise about what did and didn’t happen. No court’s own network, case-filing terminal, or clerk’s office was hacked. West Publishing operates C-Track as a hosted or licensed product that participating courts plug into for docket and case management — meaning the sensitive records those courts handle live, at least in part, on infrastructure they don’t control and can’t audit themselves. When that shared infrastructure is compromised, every court that trusted it inherits the consequences of a security failure that happened entirely outside their own walls. That structural fact is also why the disclosure came from Thomson Reuters and West Publishing rather than from any individual state court system — the courts found out they’d been affected the same way their vendor decided to tell them, on the vendor’s timeline.
Sealed doesn’t mean gone once it’s copied
The routine categories of exposed data — names, Social Security numbers, driver’s license numbers, dates of birth, medical and health insurance information — are the standard contents of a breach notice. What sets this one apart is Thomson Reuters’ acknowledgment that “confidential, redacted, or sealed information” was also affected for certain courts. A seal order restricts who may view a record through the court’s own systems and processes; it has no mechanism to reach into a vendor’s database and un-expose a file that’s already been copied out by an attacker. Whatever protection a judge intended when sealing a case — protecting a minor, shielding a witness, keeping a settlement confidential — depended entirely on West Publishing’s system being the only door to that data. It wasn’t.
West Publishing is offering 12 months of credit monitoring through Experian in the U.S. and TransUnion in Canada, along with a dedicated notification hotline — standard remediation for the identity-theft-relevant categories of data. Credit monitoring does nothing for the harder-to-quantify exposure of sealed case material, which has no equivalent restitution once it has left the system it was sealed inside.
The lessons that generalise
A vendor breach is every one of that vendor’s customers’ breach, simultaneously. Thirteen separate court systems, spanning two countries, did not individually fail any security control. They all inherited the same incident because they all depend on the same upstream platform — a dynamic worth remembering for any organization evaluating how much of its sensitive data flows through a shared third-party system it doesn’t operate.
Notification timelines have multiple clocks, and the gap between them is where trust erodes. Six months from access to public disclosure, with a further month between internal discovery and telling the actual data custodians (the courts), is not unusual for breach response — investigation and legal review take time — but it means every affected person’s data sat exposed and unremediated for months longer than the eventual notice suggests at a glance.
“Sealed” and “redacted” are legal and procedural categories, not technical ones. A seal order controls access through the court’s own processes. It provides zero protection against a breach of the underlying data store, because the sealing mechanism and the storage mechanism are different systems with different threat models — a distinction that matters for any organization treating access-control policy as if it were a substitute for data protection.
Tech-Bee is an independent technology publication. This piece is drawn from reporting by The Record from Recorded Future News, The Hacker News and Help Net Security on Thomson Reuters’ and West Publishing’s breach disclosure regarding the C-Track court case management platform.