Arizona court system breach exposes data of over 1.3 million people

Hackers stole personal information on more than 1 million people from Arizona's court system after an employee clicked a malicious link in an email, the Associated Press reported on October 6 in a story carried by SecurityWeek. The stolen data includes court debt records, protection orders and foster care reports, making the breach one of the most sensitive involving a US state judiciary this year.

What happened

According to the AP, the attack was detected and shut down on September 24, within two hours of discovery, on a backup server. Chief Justice Ann Scott Timmer said the breach was discovered after a court employee clicked a malicious link and that the FBI was notified, FOX 10 Phoenix reported. The court has described the attackers as "criminal hackers or their bots," according to The Record, which also reported that no ransomware was involved and no ransom demand had been made when the incident was first disclosed.

What data was stolen

The AP reported that the stolen files include records on 1.3 million people with unpaid court fees, fines and restitution, covering payment records going back 30 years, about 30,000 active and inactive protection orders, and 150,000 foster care board reports. FOX 10 Phoenix said the data tied to the FARE court debt collection program may include names, case numbers and Social Security numbers.

Malwarebytes reported that the attackers copied sensitive backup files and that the Foster Care Review Board reports, dating back to 2010, contain information about children, involved parties, case materials, findings and recommendations, though not addresses or phone numbers. People with current or former protection orders were among those notified, and advocates warned that their confidential location details may be at risk.

Who is affected

The court is notifying FARE participants by text message and has informed the Arizona Department of Child Safety, attorneys, judges and board members about the foster care files, according to FOX 10 Phoenix. A court spokesperson told the AP there is no evidence the data has been used or shared, that no court cases were delayed and that no records were altered or deleted. No group has claimed responsibility.

What to do

The court is urging potentially affected people to place a hold or freeze on their credit files with Equifax, Experian and TransUnion. People who receive notices should watch for phishing messages and calls that impersonate the courts, avoid acting on urgent payment demands and verify any request through official court channels. Protection order holders concerned about exposure of location details should contact the court and local victim services.