Thomson Reuters Discloses Breach of Court Case-Management Platform, Risking Exposure of SSNs and Sealed Records
Thomson Reuters disclosed that an unauthorized party accessed files from C-Track, a court case-management platform operated by its West Publishing Corporation subsidiary, in an intrusion that began in March 2026. The breach affects courts across 11 U.S. states as well as the U.S. Virgin Islands and Ontario, Canada, according to the company’s notification. West Publishing said it discovered the unauthorized activity on June 30, 2026, meaning the intrusion may have gone unnoticed for several months before detection.
Court case-management systems like C-Track handle large volumes of sensitive judicial data, and Thomson Reuters indicated that a subset of the affected records could include individuals’ names alongside Social Security numbers and material from sealed proceedings, information that courts typically restrict from public access precisely because of its sensitivity. Because the platform is used by court systems rather than a single organization, the exposure potentially touches litigants, defendants, and other parties to legal proceedings across multiple jurisdictions who had no direct relationship with Thomson Reuters and little ability to have prevented the exposure themselves.
The incident underscores a recurring theme in 2026’s breach landscape: attacks on shared infrastructure and back-office vendors can expose sensitive records far beyond the breached company’s own customer base. Court administrators in the affected jurisdictions will likely face pressure to notify impacted individuals and assess whether sealed records require additional remediation, while the incident adds to a growing list of breaches involving legal and identity-verification service providers reported in recent weeks.