A court case management platform trusted across 11 US states, the US Virgin Islands and Ontario has leaked some of the most sensitive records a justice system holds. On 2 September Thomson Reuters confirmed that C-Track, the case management SaaS run by its West Publishing unit, was accessed by an unauthorised party for roughly four months earlier this year. The stolen files reach far beyond names and case numbers, and for certain courts they include sealed and redacted material that was never meant to leave the building.
What happened
According to disclosures summarised by The Hacker News, an outside party obtained files from Thomson Reuters’ cloud environment. Unauthorised access ran from 1 March to 29 June 2026 and was discovered on 30 June. Courts and the Ontario Attorney General were notified between 23 and 27 July, and the public disclosure landed on 2 September.
The exposed data set is broad. It covers Social Security numbers, driver’s license numbers, dates of birth, and medical and health-insurance information, alongside case numbers, party names and addresses, phone numbers, and charge and docket descriptions. For some affected courts it also pulls in sealed, redacted or confidential court documents. As West Publishing put it, “Certain confidential, redacted or sealed information may have been impacted for certain affected courts.” Twenty-four court bodies are named so far, and no total individual count has been published.
How the exposure happened
The root cause is a familiar one for anyone who tests SaaS. This was not a courthouse network being popped. It was data sitting in a vendor’s cloud. The Montana Supreme Court noted that backup databases had been supplied to Thomson Reuters servers for troubleshooting, and that detail is the whole story in miniature.
Support and debugging work routinely pulls production data into places it does not belong. A backup gets uploaded so a vendor can reproduce a bug, a copy lands in a shared troubleshooting bucket, and the tight controls that guard the live system never follow the copy. The attacker had roughly four months inside before anyone noticed, which points to gaps in monitoring around that cloud environment rather than a single clever break-in. Long dwell time and copied data are the two ingredients that turn a vendor incident into a mass-notification event.
- Backup and troubleshooting data handed to a vendor and left in cloud storage without the same guardrails as production.
- Tenant and data isolation gaps, where one party’s files are reachable through paths that should be walled off.
- Weak telemetry on the cloud environment, letting access run from March to June undetected.
Why it matters
Courts hold the records people most want kept private: victims, minors, sealed settlements, protective orders. When that lands in an attacker’s hands the harm is not theoretical. North Dakota has confirmed an active criminal investigation, and the notification duties alone span two countries and dozens of jurisdictions.
For organisations in Cyprus the lesson travels well. You do not have to run a courthouse to carry this risk. Any Cyprus business that ships customer data to a SaaS provider, or hands a database copy to a vendor’s support team, is trusting that vendor’s cloud hygiene. Under GDPR you remain the controller, and a breach in your processor’s environment is still your notification, your regulator conversation, and your reputational hit. C-Track is a reminder that the weakest link is often a data copy you forgot you made.
What to do, and how we help
Treat the SaaS platforms and vendors that touch your data as part of your attack surface, not as someone else’s problem. Practical steps:
- Map where production data is copied for support, backup or troubleshooting, and set expiry and deletion rules for those copies.
- Test tenant isolation directly. Confirm that one account cannot read another’s records through the API, object storage, or shared debug endpoints.
- Demand logging and alerting on the vendor’s cloud environment, and confirm you would see access that runs for months, not just a single failed login.
- Rehearse the notification path now: who calls the regulator, who drafts customer notices, who owns the hotline.
This is exactly the ground our SaaS penetration testing covers: probing tenant isolation, data-handling flows, backup and support paths, and the access controls around the cloud storage behind the application. We test the copies and the corners, not just the login page.
If your notification window ever opens, note the practical details victims receive here: 12 months of credit monitoring (Experian IdentityWorks in the US, TransUnion myTrueIdentity in Canada), a hotline on 1-833-918-5294, and enrolment open until 31 December 2026. Thomson Reuters says there was no operational disruption and that the platform remains safe to use.
Bottom line
The C-Track breach was not an exotic exploit. It was sensitive data copied into a vendor cloud, watched too loosely, for too long. Find your own copies before someone else does, and test the isolation you are counting on.