Arizona Supreme Court

Summary

A cyberattack on Arizona’s court system resulted in the theft of personal information for approximately 1.3 million individuals, including data on unpaid court fees, fines and restitution payments spanning several decades, nearly 30,000 active and inactive protective orders, and about 150,000 foster care board reports dating back over a decade. The breach began after a court employee clicked a malicious link in an email, allowing attackers to access a backup server that was shut down roughly two hours after IT staff detected the intrusion. Officials said no records were altered or deleted, there is no evidence the stolen data has been shared or used, and court operations were not disrupted. The Arizona Supreme Court has notified affected individuals and is working with the FBI to investigate the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 24, 2026, Arizona Supreme Court technology staff detected unusual activity on a backup server and traced the intrusion to a malicious link clicked by a court employee in an email. The attackers gained access and began copying personally identifiable information from court databases. The data exfiltrated included records of unpaid court fees, fines, and restitution payments for traffic and criminal violations for approximately 1.3 million individuals, some dating back more than three decades. In addition, the attackers copied nearly 30,000 active and inactive orders of protection and 150,000 foster care board reports dating back to 2010.

The breach exposed personal information of over one million people, with the Arizona Supreme Court confirming the figure at 1.3 million. Among the compromised data were confidential addresses associated with protective orders, which victims described as leaving them feeling vulnerable. Officials stated there was no evidence that the stolen information had been altered, deleted, shared, or used for any fraudulent purpose at the time of disclosure. The attack did not affect or delay any ongoing court cases, and no juror, witness, or court employee data was taken.

Upon detection, court IT staff isolated the backup server and halted the unauthorized access within approximately two hours. The Arizona Supreme Court initiated a notification campaign, sending emails to affected individuals outside regular business hours to advise them of the potential exposure. Communications included specific guidance for those with protective orders, noting that their confidential address on file may have been compromised and advising them to contact local law enforcement if they felt endangered. The court system also engaged the Federal Bureau of Investigation, which is assisting in identifying the attackers and determining whether the data has been disseminated.

Sources

Sources available to members: 5 sources.