A unit of Thomson Reuters detected a cybersecurity incident on June 30 affecting its C-Track case management platform across 11 U.S. states, the U.S. Virgin Islands and Canada, the company said. A subsequent investigation found that an unauthorized party obtained certain C-Track files in March; some court records were “affected” and included names and personal information, according to a company website set up to provide information about the incident.
The West Publishing unit website lists the U.S. states with impacted court systems as Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire and Wyoming, as well as the U.S. Virgin Islands.
C-Track impact and response
A joint statement from the chief justices of the Court of Appeal for Ontario, the Ontario Superior Court of Justice and the Ontario Court of Justice said Thomson Reuters detected unauthorized activity in one of its cloud environments and had taken steps to contain it, working with Ontario’s Ministry of the Attorney General and the courts. The statement said the company engaged external cybersecurity experts, notified law enforcement and secured the C-Track environment.
Thomson Reuters confirmed it took containment and security measures and that affected customers have been notified. A company spokesperson said, “There has been no operational disruption to C-Track as a result of this incident. Our products and services remain fully operational and are safe to continue to use. Independent cybersecurity experts assisted in the investigation and validated the remediation measures implemented.”
It is unclear who was responsible for the incident or exactly what information was compromised. The chief justices’ statement said individuals involved in court proceedings or mentioned in court documents could have had personal information relating to them involved in the incident.
The chief justices said Thomson Reuters Canada will respond to inquiries and will set up a call center that will be active on September 4. A Thomson Reuters spokesperson also confirmed the company was responding to inquiries in the U.S. and Canada and will have a contact center.
