Arizona Supreme Court

Summary

Arizona Supreme Court officials disclosed that a cyberattack on the state court system exposed personal information, including addresses of individuals with protective orders, after IT staff detected and halted the intrusion within the last 36 hours. The breach prompted notifications to affected individuals, involvement of the FBI in the investigation, and statements from victims such as Ashley who expressed feeling vulnerable about the possible exposure of her confidential address.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Court IT staff discovered the cyberattack on the Arizona state court system and moved quickly to shut it down, a fact announced by Arizona Supreme Court Chief Justice Ann Scott Timmer on Friday night. She stated that the breach occurred within the last 36 hours and that officials believe criminal hackers or automated bots copied personally identifiable information belonging to many Arizonans. The Supreme Court’s Administrative Office of the Courts began working to notify everyone it believed was affected, emphasizing that there is no evidence so far that the hackers have shared the stolen information with anyone else. Timmer said she immediately called her team together after learning of the attack, spoke with the top‑ranking FBI leader in the state, and pledged full commitment to supporting the FBI’s investigation and minimizing the likelihood that the information would be used to further jeopardize Arizonans. The attack was described as targeting court records broadly and not aimed at any specific individual.

The court system began emailing people directly affected by the breach on Friday night, sending urgent notices to Arizonans with a current or past protective order whose confidential address on file with the court may have been compromised. The notification explained that the recipient was receiving the official notice after regular business hours because it involved information about their protective order, including their address on file with the court, and that although the court system has significant safeguards, no computer network is 100 percent secure. It stated that within the last 36 hours the state court system was the target of a cyberattack by criminal hackers or their bots, that court IT staff discovered the attack and took steps to stop it as quickly as possible, and that the hackers copied personally identifiable information about many Arizonans, including the recipient’s location, with the format of the copied data making it unclear whether most of it can be easily read. The notice added that there is no evidence the hackers have shared the information with anyone, that the attack was not targeted directly at the recipient, that the court has initiated its cybersecurity action plan, that the investigation is ongoing and includes work with the FBI to identify the hackers and minimize the likelihood the information will be shared, and that law enforcement has been alerted. Ashley, who asked not to share her full name or show her face, said reading the email made her feel very vulnerable and that she is now afraid her safety is at risk because she has had a protective order against her abuser for several years. Lisa Bell, chief development officer at A New Leaf, said the nonprofit was also alerted directly by the courts and noted that while the breach was not expected, it underscores the need to be prepared for worst‑case scenarios, especially given that Arizona judges grant thousands of protective orders each year and the full extent of the data theft remains unclear.

In response to the incident, court officials urged anyone who believes they are in danger because of the breach to contact local law enforcement and directed individuals with questions to check AZCourts.gov for the latest updates. John Iannarelli, a retired FBI special agent, commented that the FBI has the best cyber investigators in the world and suggested that the breach may have resulted from a bot finding an open system or possibly someone clicking on the wrong thing, stressing that such activity needs to be stopped and corrected. He also noted that while online crime occurs daily, a statewide court system being targeted is especially concerning because protective order records can contain names of witnesses, victims, and addresses that the person seeking protection does not want the abuser to know about. Authorities reiterated that there is currently no evidence the criminals have shared the personal information with anyone and that, until such information appears online or a demand arises, it is safe to assume nobody has been damaged as of yet. The investigation remains ongoing, with the court system continuing to work with the FBI and law enforcement to identify the perpetrators and mitigate further risk.

Sources

Sources available to members: 1 source.