Thomson Reuters has offered no details on the intrusion's entry point, the intruder's identity, the amount of data taken, or the number of people affected [9]. The company's framing is that the activity sat inside its own environment and was not caused by court networks, systems or data security [10]. That framing is accurate, but it also describes the exposure, since no court on the list had a sensor in the path. C-Track never went down and remains fully operational, and the company says it added new controls that outside experts reviewed and approved, without naming those experts [14]. It says there is no evidence that systems processing financial transactions were touched [24].
The intervals are the firmest numbers here. First known file access to detection is at least three months [3]. Detection to the first court notifications is 23 days [1]. Detection to the public statement on 2 September is 64 days [2].
Counting affected courts depends on which notice you read. The US notice, as reported by The Record, names appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee and Wyoming, several Pennsylvania courts, 10 Ohio district courts of appeals, and the Virgin Islands Supreme and Superior courts [15]; Oregon's Judicial Department disclosed separately [16]. The West Publishing statement, as reported by Infosecurity Magazine, says 11 US states and lists North Dakota twice, which leaves ten distinct states, with neither Wyoming nor Oregon among them [17]. Anyone scoping from that second list is short by two states and a repeat [4]. On the Canadian side, the named exposure is C-Track Canada files tied to three Ontario courts: the Court of Appeal for Ontario, the Superior Court of Justice and the Ontario Court of Justice [18]. The investigation to establish what content was taken at each court, and how many individuals it covers, is still open [25].
The remedy on offer is 12 months of credit monitoring and identity theft protection [23]. That covers only one part of what was exposed, names, Social Security numbers, driver's license numbers, dates of birth, medical information and health insurance information [11], and leaves out the confidential, redacted or sealed material the company says may have been affected at some courts [12]. Infosecurity notes court filings are sought by nation-state groups for espionage, by actors trying to influence particular cases, and by criminals extorting named individuals [26]. Thomson Reuters says there is no evidence of fraud or misuse to date [13]; for a sealed filing already copied, that indicator would not move either way.
There is no attribution. So whether C-Track was an opportunistic hit on one vendor, or part of the same interest in case-management systems that pushed the US federal judiciary to announce stronger document protections in August 2025 after attacks on its filing system [27][28], is unresolved in what has been published.
