Earlier this month, courts across the country began warning people that personal information may have leaked: Social Security numbers, driver's license numbers, dates of birth, medical details, health insurance information. Some of it may have been confidential, redacted, or sealed — records a judge had specifically ordered protected.

The breach didn't happen at the courts. It happened at a software vendor.

C-Track is a court case management platform sold by West Publishing, part of Thomson Reuters — one of the biggest names in legal publishing. According to the company's account, an unauthorized party obtained C-Track files beginning in March 2026. The access ran until the end of June. The vendor noticed it June 30. The courts were told in late July. The public learned about it September 2.

That's roughly six months from break-in to public notice, and about three months during which an unauthorized outsider was inside a system holding court records from eleven states, the U.S. Virgin Islands, and three courts in Ontario, Canada. Minnesota's courts weren't named in the vendor's notice but have confirmed separately that their data was affected, so the count may still grow.

There's no evidence yet that the data has been misused, and an active criminal investigation is underway. The company says C-Track never stopped running and is offering affected individuals twelve months of credit monitoring. But "the system still works" was never the question. The records were the point.

The detail that matters most

Two facts in the disclosures deserve more attention than the number of states.

The exposed data was, by several courts' accounts, backup material. Montana's Supreme Court said the files taken were database copies the state had supplied to the vendor for troubleshooting the applications. Minnesota's judicial branch described the affected information the same way: backup data the courts had provided.

And Alabama's appellate courts were told something stranger: a copy of their data sat in a backup file inside the vendor's cloud environment — a backup the courts said they had neither requested nor known about.

Put those together and the picture is uncomfortable. The security of your data doesn't end at your network. It extends to every copy a vendor holds, including copies made for housekeeping reasons you never approved and may never hear about.

You would never have flagged this vendor

If your business ran a vendor review tomorrow, Thomson Reuters would pass it easily. Decades-old company, a fixture of legal and news publishing, serious infrastructure. This is not a story about a two-person startup cutting corners.

An established vendor still went three months without noticing an intruder, held backup copies its customers didn't know existed, and took weeks to tell the affected courts after it knew. Nobody has said publicly how the attacker got in or who they are.

The point isn't that big vendors are careless. It's that size and reputation protect you only up to the moment a copy of your data leaves your control. A vendor doesn't have to be reckless. One quiet intrusion and one untracked backup, and your information is in somebody else's breach.

What a serious customer response looks like

Minnesota's judicial branch is worth copying. When it learned what had happened, it terminated the vendor's access to its electronic environments, audited its accounts, and required password changes for everyone using the affected system. Then it told the public what it knew and what it didn't.

Cut access, check everything, tell people. None of that requires a security department. It requires deciding, ahead of time, that a vendor's security problem is your problem — because legally and reputationally, it is.

Questions worth asking your vendors

You can't audit every vendor. You can ask better questions than most businesses bother to ask.

  • What copies of our data exist outside production? Backups, test environments, exports, and troubleshooting copies are where data quietly accumulates. Montana's exposed files were troubleshooting copies.
  • Who gets told when a new copy is made? In Alabama's case, nobody outside the vendor. Ask that new copies involving your data be reported to you as a matter of policy.
  • How fast can you cut our access? Minnesota's first move was terminating the vendor's access outright. If your vendor can't answer in days, that's the answer.
  • When would you notify us? Here, courts learned weeks after the vendor did. Ask for a notification commitment in writing, with a timeline attached.
  • What happens to our data when we leave? Offboarding should include deletion or return of every copy, with confirmation.

The Bottom Line

The courts did nothing wrong. By the vendor's account, their networks were never touched. Their data was exposed anyway, because copies of it lived on someone else's servers — including at least one copy they didn't know about. The same is true of nearly every business that runs on cloud software, payroll services, or hosted anything.

You don't need to swear off vendors. You need to know what they're holding, why, and who would call you if something went wrong. Vague answers to those questions are a finding in themselves.

If nobody in your business owns vendor risk, have a conversation with someone who does this for a living — before the next notice goes out in someone else's name.