Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data

The Hacker News

September 3, 2026 at 2:39 PM

Overview

Thomson Reuters has reported a significant data breach involving its C-Track court case management software, which may have exposed sensitive information, including Social Security numbers and sealed court records. The breach, which was discovered on June 30, 2026, actually took place back in March 2026, affecting courts across 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. This incident raises serious concerns about the protection of personal data within the judicial system, as a subset of the compromised records contains individuals' names. The delayed discovery and disclosure of the breach highlight potential vulnerabilities in the security measures around court management systems. Users and stakeholders in the affected regions need to be aware of the risks associated with this exposure and consider steps to mitigate potential identity theft or misuse of their information.

Key Takeaways

Affected Systems: C-Track court case management software, Thomson Reuters, West Publishing Corporation
Timeline: Disclosed on June 30, 2026

Original Article Summary

Thomson Reuters disclosed on Wednesday that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing Corporation unit, in March 2026, affecting courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. West Publishing said it discovered the activity on June 30, 2026. A subset of court records could contain individuals' names

Impact

C-Track court case management software, Thomson Reuters, West Publishing Corporation

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Disclosed on June 30, 2026

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Read Original Article

Related Coverage

Attackers exploit zero-days in consistently besieged SonicWall product

CyberScoop

SonicWall's SMA 1000 appliances are facing significant security challenges, with attackers actively exploiting five zero-day vulnerabilities since late 2025. These vulnerabilities have put SonicWall customers at risk, as they have been under attack for years. The ongoing exploitation means that organizations using these devices need to be particularly vigilant about their security posture. This situation raises concerns about the reliability of SonicWall products and highlights the importance of prompt patching and updates to mitigate such risks. As attackers continue to target these vulnerabilities, it is crucial for affected users to stay informed and take necessary precautions.

Sep 3, 2026

Coder's registry infrastructure compromised to push malicious modules

BleepingComputer

Attackers have breached Coder's Cloudflare infrastructure, enabling them to insert unauthorized registry servers. These servers distributed malicious Terraform modules that contained code designed to steal user credentials. This incident poses a significant risk to developers and organizations that rely on Terraform for infrastructure management, as they could unknowingly use compromised modules, leading to potential data theft and security breaches. Users of Coder's services need to be vigilant, as the malicious code could affect their systems and expose sensitive information. The incident underscores the necessity for robust security measures when integrating third-party modules into development workflows.

Sep 3, 2026

HPE patches critical ArubaOS-CX remote code execution flaw

BleepingComputer

Hewlett Packard Enterprise (HPE) has addressed a serious security vulnerability in its ArubaOS-CX network operating system. This flaw could allow attackers to execute remote code, potentially compromising affected systems. Organizations using ArubaOS-CX are at risk, as this vulnerability could lead to unauthorized access and manipulation of network functions. HPE has released patches to fix the issue, and it's crucial for users to update their systems promptly to prevent exploitation. Cybersecurity experts recommend that companies prioritize applying these updates to safeguard their networks from potential attacks.

Sep 3, 2026

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

The Hacker News

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

Sep 3, 2026

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

The Hacker News

Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.

Sep 3, 2026

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

SecurityWeek

The Manchester Airports Group (MAG) has suffered a significant data breach, with hackers leaking around 550GB of sensitive information related to 8.8 million individuals. This incident occurred after MAG reportedly declined to meet the ransom demand from the attacking group. The hackers claimed they accessed the data through exposed administrative keys, raising concerns about the security measures in place at the airport group. This breach not only compromises the personal information of millions but also highlights the ongoing risks organizations face from ransomware attacks and the importance of securing sensitive data. As the fallout from this incident unfolds, it serves as a reminder for companies to reinforce their cybersecurity practices and be vigilant against potential vulnerabilities.

Sep 3, 2026