C-Track breach reached at least twelve judiciaries, including Ontario

The person at the end of this filed an appeal some years ago and wrote a Social Security number on a form because the form asked for one. They did not choose C-Track and cannot audit it ^[1]. What arrives is a letter listing a name alongside a Social Security number, a driver's licence number, a date of birth, medical information and health insurance information ^[7], and in Minnesota the possibility that a confidential or sealed document travelled with it ^[8].

The most useful sentence in the whole set of notices belongs to Kentucky's Administrative Office of the Courts, which said its trial courts were untouched because the state does not use an outside vendor for trial court e-filing ^[11]. One judiciary, one class of record, and the exposure follows the procurement decision rather than anything a courthouse did. Montana made the same point from the other side when it told parties that the data sat on Thomson Reuters servers rather than its own ^[12].

The timeline runs like this: the activity was detected on 30 June, according to Reuters ^[3], and the files had gone in March ^[2]. Montana was told on 23 July, 23 days after detection ^[3]. The public heard on 2 September ^[4], which is 64 days after detection once you add July's 31 days, August's 31 and two more ^[1]. Montana held that knowledge for 41 days before the public disclosure came ^[2], on a schedule the state did not set.

Both official statements about impact are statements about availability. Thomson Reuters said there has been no operational disruption to C-Track and that its products and services remain fully operational ^[9]. Kentucky said its appellate courts were not functionally impaired ^[10]. The remediation runs on the same axis: the mandatory password reset rotates the one item on the list that can be rotated, and twelve months of credit monitoring puts an expiry date on exposure that a Social Security number does not have ^[13].

For anyone buying a system that will hold records belonging to other people, two columns sort the vendors faster than an uptime table. The first is whether the data is rotatable, like passwords and session tokens, or permanent, like the dates of birth and medical filings in these court files ^[7]. The second is who tells your users on the day the vendor knows, and by when, in writing. A supplier in the permanent column with no named notification clock is one where the contract describes the wrong failure. Thomson Reuters sells courts on being the safe place to put a docket, and its legal division is the profitable core of the company ^[19], so the leverage to ask for that number exists. This incident produced 23 days to the customer and 64 to the public ^[3][1]. A renewal that cannot beat it has priced a litigant's Social Security number at twelve months of monitoring ^[13].