Thomson Reuters breach hit court systems in US and Canada
The company doesn’t know who was behind the intrusion.
The Thomson Reuters logo on the company's building. REUTERS/Jeenah Moon/File Photo
- Thomson Reuters found unauthorized access to C-Track files after detecting activity on June 30.
- The incident hit court systems in 11 US states, the US Virgin Islands, and Ontario.
- Some affected court records included names and personal information, but specific compromised data remains unclear.
- Thomson Reuters says C-Track remains fully operational and affected customers have been notified.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A unit of Thomson Reuters detected a cybersecurity incident in 11 US states, the US Virgin Islands and Canada on June 30th involving the company's C-Track case management platform, according to a notice from the company on Wednesday and a statement by the chief justices of three Ontario courts, which use the platform for digital court record management.
A subsequent investigation by Thomson Reuters found that an unauthorized party obtained certain C-Track files in March, the company said on a website created to provide information about the incident. The company's investigation found some court records were ”affected” and they included names and personal information, the website said.
A website set up by the West Publishing unit of Thomson Reuters to answer questions about the hack said it hit court systems in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire, Wyoming and the US Virgin Islands.
The statement from the chief justices of the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice said Thomson Reuters detected unauthorized activity in one of its cloud environments, and had taken steps to contain the activity, working with Ontario's Ministry of the Attorney General and the courts.
”We are advised that Thomson Reuters responded by taking steps to contain the activity, engaging external cybersecurity experts to advise and investigate, notifying law enforcement, and securing the C-Track environment,” the statement said.
Toronto-based Thomson Reuters confirmed that it took containment and security steps and that affected customers have been notified.
”There has been no operational disruption to C-Track as a result of this incident,” a Thomson Reuters spokesperson said. ”Our products and services remain fully operational and are safe to continue to use. Independent cybersecurity experts assisted in the investigation and validated the remediation measures implemented.”
It is unclear what information may have been compromised, the chief justices' statement said. They said that individuals involved in court proceedings or mentioned in court documents could have had personal information relating to them involved in the incident.
Reuters could not independently determine who was responsible for the incident or specific details about the information that was compromised. Reuters News is a division of Thomson Reuters.
The chief justices' statement said Thomson Reuters Canada would respond to all inquiries and would set up a call center that will be active on September 4. The Thomson Reuters spokesperson confirmed the company was responding to inquiries in the US and Canada and will have a contact center.
In 2022, Cybernews researchers found an exposed Thomson Reuters database with several terabytes of data. At the time, the company's leading theory as to why the information was left unprotected was that an “isolated error in the product environment resulted in the inadvertent misconfiguration of the non-production environment.”
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.