Security2 publishers2 min readPublished
Arizona's court system says hackers copied residents' data without deploying ransomware
Arizona's Supreme Court says hackers copied personal data on "many Arizonans," with no ransomware deployed and no ransom demand as of Monday. For the people in those records, the risk now is direct misuse of the data, and no extortion talks are under way to show what the thieves intend.
The Watch · Security desk
What happened
- The Administrative Office of the Courts is working to alert as many people as possible whose information it believes the hackers copied.
- Chief Justice Ann Scott Timmer said the court will not release further details because they may affect the investigation into the attack.
- No hacking group has publicly taken credit for the attack.
- The court's alert page says official messages about the attack will arrive by email from one designated court address.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Breach notices are an easy template for phishing, and the court's page already tells readers it is not a scam, so a court email about the breach can be trusted only if it matches the designated sender.
- constraint Until the court publishes scope, people cannot tell which of their records were copied, so they cannot aim fraud protections at specific accounts or identifiers.
- decision Courts and agencies with incident plans built around ransomware outages need a way to spot bulk copying of records, since a theft like Arizona's has so far come with no encryption and no ransom note.
"Court leaders believe the criminal hackers copied personally identifiable information about many Arizonans," Chief Justice Ann Scott Timmer said [3]. On method, the court has said only that the attackers were criminal hackers "or their bots" [2]. The court has not said how many people are affected, which data fields were copied, how the intruders got in, or when [6].
The ransom facts come from a court spokesperson. The spokesperson told Recorded Future News that the incident did not involve ransomware and that no demand had arrived as of Monday [5]. That covers three days after the Friday announcement [2]. Three days without a demand does not show what the thieves want, and it does not rule out a demand later. Timmer pointed to misuse of the records. "I personally spoke with the topranking FBI leader in the state, and I pledged our full commitment to supporting their investigation and minimizing the likelihood that the information will be used to further jeopardize Arizonans," she said [7].
Recorded Future News attributes the steady targeting of courts to the sensitive personal information and law enforcement data held on judicial servers [9]. The three recent cases it describes in detail were ransomware. In Kansas, a 2023 attack shut down nearly all of the state's courts, and full recovery took months [10]. In November, ransomware at the Pennsylvania Office of the Attorney General snarled that state's courts for nearly a month and forced time extensions in some criminal and civil cases [12]. The same month, ransomware hit the Georgia organization that manages real estate and civil court filings [13]. Courts in nine other states have faced ransomware, DDoS incidents or data breaches over the past four years [11][1].
Kansas, Pennsylvania and Georgia were outages. The job in each was getting systems back. Arizona's incident, as the court describes it, is a copy of records [3]. Copying data does not require taking a system offline, so there may be nothing to restore. The remaining work is finding which records left and reaching the people in them before the data is used.
What to watch
- A ransom demand or leak-site posting tied to the Arizona court data after the spokesperson's Monday statement.
- Notification letters or a regulatory filing from the court giving the number of people affected and the data fields copied.
- An FBI attribution to a named group, which would show whether this belongs to a wider campaign against courts or stands alone.