What Arizona’s Court Breach Exposed

• A phishing link apparently opened the door to backup court files containing sensitive information tied to roughly 1.3 million people.
• Hackers also copied nearly 30,000 protective-order records and more than 150,000 Foster Care Review Board reports dating as far back as 2010.
• The FBI is investigating, but Arizona’s courts still face a larger question — how did one employee click reach records this sensitive, and what changes will prevent it from happening again?

Arizona’s court system is dealing with something far more serious than a routine computer intrusion. Criminal hackers gained access to backup court files containing Social Security numbers, protective-order information and detailed reports concerning children and families involved in dependency proceedings.

Evidence gathered so far indicates the September 24 attack began when a court employee received a phishing email and clicked a malicious link. Court technology staff detected the intrusion and shut it down less than two hours later.

Two hours may sound fast. In cybersecurity, it can be an eternity.

The attackers copied information concerning approximately 1.3 million people referred to Arizona’s Fines/Fees and Restitution Enforcement Program, including names, case numbers and Social Security numbers. Some of those court debts date back 30 years.

Nearly 30,000 active and inactive protective-order records were also copied. Those records deserve particular scrutiny because protective orders frequently involve allegations of domestic violence, harassment, stalking or threats. The Arizona Supreme Court acknowledges that some sensitive information was contained in those records.

Then there are the dependency records.

Hackers copied more than 150,000 reports prepared by Arizona’s Foster Care Review Board dating back to 2010. These are not simply administrative forms. According to the court itself, the reports can contain information about children, interested parties, statements made during proceedings, reports considered by reviewers, findings across 11 categories and recommendations made to judges, the Department of Child Safety, parents and other parties.

That makes the breach important for another reason.

Those records could provide an outsider with an unusual window into how the review board evaluates families, what evidence it considers significant, what findings it makes and what recommendations it sends to juvenile court judges. That does not mean hackers targeted the records for that purpose — investigators have not publicly established a motive — but determining why these particular files were taken should be part of the investigation.

The court says the copied backup data was highly compressed and that it currently has no evidence the information has been used, shared or even successfully read. No records were altered or deleted, and court proceedings have not been disrupted.

That is encouraging. It is not the same as knowing the stolen data is safe.

Chief Justice Ann Timmer contacted FBI Special Agent in Charge Rebecca Day, and both state and federal law-enforcement authorities have been contacted. The court also says it will conduct a full review of the incident and make changes needed to better protect court information.

Victims deserve specifics as that investigation moves forward.

Who carried out the intrusion? Were the files decrypted or extracted after they were copied? Did the attackers establish persistence elsewhere in the network? Have any of the records appeared on criminal forums, private marketplaces or data-leak sites? What controls failed between the phishing click and the backup server? And when will the public see the results of the court’s promised internal review?

The court has begun giving affected people practical guidance. Individuals connected to the FARE database are being encouraged to freeze or place holds on their credit files and use federal and Arizona identity-theft resources. The judiciary has also established an online tool allowing people to check whether their information was accessed.

Arizona did disclose the attack publicly on September 25, the day after it occurred. But disclosure is only the beginning.

A judicial system routinely demands that citizens trust it with some of the most private material imaginable — Social Security numbers, allegations of abuse, family histories, dependency findings and protective orders. When criminals reach that material, accountability cannot end with notification letters.

The public deserves to know exactly how the defenses failed, what the attackers obtained and what has changed because of it.

About the Author

Samuel López is a reporter and news correspondent for USA Herald who has reported for the publication since 2022. He is also a seasoned legal analyst with more than two decades of experience working with state and federal litigation, court records, evidentiary materials and complex legal matters. That background informs his reporting on judicial accountability, privacy, cybersecurity incidents affecting legal institutions, and the handling of sensitive records entrusted to courts.

Stay Ahead of What Happens Next

If you value reporting that goes beyond the initial headline and examines the legal, investigative and accountability questions behind major stories, sign up for USA Herald’s exclusive newsletter for investigative reporting, breaking legal developments and national-security coverage.

Follow USA Herald on X at RealUSAHerald.