KEY TAKEAWAYS
- Attackers copied personal data from Arizona’s court system after a court employee clicked a malicious link in a phishing email.
- 1.3 million people are affected — records of unpaid court fees, fines, and victim restitution stretching back roughly 30 years.
- Also copied: nearly 30,000 orders of protection and more than 150,000 foster-care review reports dating to 2010.
- The stolen data may include names, case numbers, and Social Security numbers; the court says the backup copy taken was highly compressed.
- The attack was spotted on Sept. 24 and shut down within about two hours. The FBI has been notified; the hackers have not been identified, and there is no evidence the data has been used or shared.
- If you are affected, the court recommends freezing your credit files with Equifax, Experian, and TransUnion, and checking identitytheft.gov for guidance.
The whole thing started with one email. Somewhere inside Arizona’s court system, an employee opened a message, clicked a link they shouldn’t have, and gave intruders a way in. Weeks later, the Arizona Supreme Court confirmed the scale of what followed: personal information for about 1.3 million people, quietly copied out of a backup server before the court’s own technology staff spotted the intrusion on Sept. 24 and shut it down roughly two hours later.
What the attackers got
The biggest haul came from the court’s Fines, Fees and Restitution Enforcement program — FARE, the statewide operation that collects unpaid court-ordered debt for civil traffic, criminal traffic, and criminal violations. The copied records go back as far as 30 years and cover people with outstanding fees, fines, and victim restitution payments. Local reporting says the data includes names, case numbers, and Social Security numbers.
It wasn’t only debt records. The attackers also took nearly 30,000 active and inactive orders of protection, and more than 150,000 reports from the Arizona Foster Care Review Board, which evaluates dependency cases where parents are alleged to be unfit or unable to care for a child. Those reports reach back to 2010 and contain general case information, child information, and the names and statements of interested parties. One woman who had sought a protective order told a Phoenix television station she received an email Sept. 25 warning that her records may have been compromised — a particularly cruel twist for people who turned to the courts precisely because they feared for their safety.
The response
Chief Justice Ann Scott Timmer disclosed the attack in a Sept. 25 news release, saying she had spoken with the state’s top FBI leader and that the court was reaching out to everyone affected. “As soon as I learned about this outrageous criminal attack on Arizona’s Courts, I immediately called our team together to formulate a response,” she said.
The court has been careful to draw the line between what was copied and what is known to have been exploited. “We don’t have any evidence it has been used or shared,” court spokesperson Alberto Rodriguez said, adding that the data came from a backup server where it was stored in highly compressed form — meaning whoever took it would still have to decipher it. No records were altered or deleted, no court cases were delayed, and the court says information about jurors, witnesses, and employees was not stolen. As of late September, investigators had not identified who was behind the intrusion, which Rodriguez described as untargeted — an opportunistic break-in through a phishing email, not a strike aimed specifically at the courts.
For the 1.3 million people in the FARE program, notifications are going out by text message. The court’s advice is direct: consider a freeze on your credit files through the three major reporting agencies, and look at the guidance on identitytheft.gov and the Arizona attorney general’s data-breach page.
Why this matters
Courthouses keep the kinds of records most institutions are forbidden from assembling: names, addresses, birth dates, Social Security numbers, family disputes, criminal histories, child-welfare cases — the raw material of identity theft, blackmail, and targeted scams, all in one place. Arizona is not an outlier here. Bloomberg Law noted the breach follows a string of attacks on court systems, including “unauthorized access” disclosed by Montana’s Supreme Court in September, and federal trial courts have spent the past year restricting access to sealed documents after years of intrusions by foreign government hackers.
The uncomfortable detail in Arizona’s case is the backup server. Backups exist to save an organization after disaster strikes; here the backup itself became the prize. It is a reminder that archived data is still live data — three decades of records the court no longer needs day-to-day remain valuable to criminals the moment they can be read. Compressing old files is not the same as protecting them.
And the entry point was not some exotic zero-day. It was an email and a click, the oldest trick in the book, defeating the security of an institution most people assume is armored. Courts are beginning to look like hospitals did a decade ago: essential, underfunded on technology, and sitting on exactly the data attackers want. Until that changes, the next click is only a matter of time.
One Comment