Arizona Court System Confirms Massive Data Breach Affecting 1.3 Million People
Arizona court officials announced that cybercriminals gained unauthorized access to backup files within the state’s judicial network, compromising the personal information of more than 1.3 million individuals. The breach was confirmed in an updated FAQ released this week, which detailed findings from federal and state investigators who verified that hackers had accessed and copied sensitive court data.
Breach Originated in FARE Program, Exposing Decades of Financial and Legal Records
The intrusion specifically targeted the Fines/Fees and Restitution Enforcement (FARE) Program, a statewide system used to collect outstanding debts related to traffic violations and criminal offenses. Investigators determined that the breach exposed data dating back 30 years, including names, Social Security numbers, and case numbers for approximately 1.3 million people. Court officials noted that while the file format may hinder immediate readability by attackers, the data remains highly sensitive and poses significant risks of identity theft and fraud.
Foster Care Review Board Records Also Compromised, Affecting Thousands of Children
In addition to the FARE breach, hackers accessed records generated by the Foster Care Review Board, which oversees child welfare cases and provides recommendations to juvenile court judges. The compromised materials include over 150,000 reports from current and past cases dating back to 2010, containing detailed family statements, investigative findings, administrative notes, and sensitive information about children in the system. Of particular concern, the breach exposed records involving approximately 8,000 children currently in foster care.
Protective Orders and Additional Court Documents Also Accessed by Attackers
The investigation revealed that cybercriminals also copied files related to both active and inactive protective orders, which often contain highly personal and safety-critical information. Arizona’s court system has since issued breach notifications to the Department of Child Safety, legal representatives for parents, judges, and members of the Foster Care Review Board to alert them of the potential exposure.
Timeline and Response: Phishing Suspected as Initial Entry Point
According to the Arizona Supreme Court, the cyberattack began on September 24 and continued until September 25, when the IT team disconnected the entire system to halt further unauthorized access. The public disclosure was made on September 25 by Arizona Supreme Court Chief Justice Ann Scott Timmer, who confirmed she had spoken directly with FBI Special Agent in Charge Rebecca Day about the incident and is coordinating recovery efforts with state and federal agencies.
Investigators Point to Phishing Email as Likely Attack Vector
The updated FAQ states that investigators believe the breach originated from a phishing attack, in which a court employee clicked a malicious link embedded in a fraudulent email. This initial compromise allowed attackers to move laterally within the network and access backup storage systems containing the compromised data.
No Ransomware Involved, No Group Has Claimed Responsibility
Court officials have confirmed that the incident did not involve ransomware encryption, and the attackers have not issued any ransom demands for the stolen data. As of the latest update, no hacking group has claimed responsibility for the breach. A spokesperson for the court system previously told Recorded Future News that there is no evidence of extortion attempts tied to the attack.
Source: The Record