Thomson Reuters Discloses Data Breach of Court Management Software

Thomson Reuters has disclosed a cybersecurity incident affecting its C-Track case management platform, which is used by courts for digital record management. An investigation found an unauthorized party gained access to and obtained certain files containing personal information from court records in March.

Incident Details

According to a company notice and a website established to inform the public, the incident was first detected on June 30. The breach impacted court systems in multiple jurisdictions that use the C-Track software.

The affected locations include:

• 11 U.S. states: Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire, and Wyoming.
• The U.S. Virgin Islands.
• The Canadian province of Ontario.

A statement from the chief justices of three Ontario courts confirmed that Thomson Reuters detected unauthorized activity in one of its cloud environments. The company's investigation determined that some court records containing names and other personal information were "affected."

Ad

Company Response and Mitigation

Thomson Reuters stated it has taken steps to contain the threat and secure the C-Track environment. The company engaged external cybersecurity experts to assist in its investigation, implemented remediation measures, and notified law enforcement, according to both the company and the Ontario chief justices.

A Thomson Reuters spokesperson confirmed that all affected customers have been notified. "There has been no operational disruption to C-Track as a result of this incident," the spokesperson said. "Our products and services remain fully operational and are safe to continue to use." The company has also set up a call center to handle inquiries from those potentially affected in both the U.S. and Canada.

Market and Investor Context

While Thomson Reuters has assured that its services remain operational, the breach of a platform containing sensitive court data represents a significant reputational risk. The full scope of the compromised information remains unclear, according to the statement from the Ontario chief justices. For investors, the focus will be on the company's ability to manage the fallout, the potential for regulatory scrutiny, and the long-term impact on customer trust in its legal software products.