Ontario chief justices warned on Sept. 2 that personal information of people involved in the province’s court system may have been stolen after a cyberattack on C-Track, an online case-management platform owned by Thomson Reuters Canada Limited.
C-Track breach details
Thomson Reuters Canada Limited detected “unauthorized activity” within one of its cloud environments on June 30 and began an investigation that found the breach began in March. The company posted a public notice on Sept. 2 signed by Ontario Chief Justice Michael H. Tulloch, Patrick J. Boucher, chief justice of the Ontario Superior Court, and Sharon M. Nicklas, chief justice of the Ontario Court of Justice. The notice says the Court of Appeal for Ontario, the Ontario Superior Court of Justice and the Ontario Court of Justice all use C-Track to store and manage court documents and records.
Scope and data potentially exposed
Thomson Reuters said court records related to the three Ontario courts were obtained by “an unauthorized party.” The company added that data from the courts was affected but that the incident was not caused by the courts’ networks or data security. It also said “Certain confidential, redacted or sealed information may have been impacted for certain affected courts.” The company noted that names and other personal information were potentially accessed but did not specify what kinds of personal information or how many records were involved, nor how far back the records go.
Courts using C-Track in several U.S. jurisdictions were also affected, including Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire and Wyoming, as well as the U.S. Virgin Islands. A U.S. website for those affected says some of the personal information that may have been accessed includes driver’s licence numbers, social security numbers and medical information. The New Hampshire Judicial Branch indicated that records in its system affected by the breach cover a period between 2002 and 2015.
Response and support
Thomson Reuters said additional cybersecurity measures are now in place to better protect C-Track systems and data and that “Our products and services remain fully operational and are safe to continue to use.” The company launched a website, is operating a call centre for inquiries and is offering credit monitoring to affected individuals. It did not provide an estimate of how many Ontarians could be vulnerable, and a company spokesperson was not available for an interview.
The statement from Ontario’s chief justices stressed the courts’ commitment to handling the incident: “We remain committed to transparency.” It added, “Throughout this process, our priority is to ensure support for potentially affected individuals, safeguard information entrusted to the courts, and work collaboratively with the government of Ontario to strengthen security measures and reduce the risk of similar incidents in the future.”
The audio version of this article is generated by AI-based technology. Mispronunciations can occur.
