Thomson Reuters' C-Track breach shows where court records live

West Publishing, the Thomson Reuters subsidiary behind the C-Track court case-management platform, disclosed on 2 September that an unauthorized party obtained C-Track files, The Hacker News reported. West found the activity on 30 June; Montana's court says access to one storage location ran from 1 March to 29 June, the outlet said. West's notice lists 24 court bodies in 11 states and the U.S. Virgin Islands, and three Ontario courts were also affected, the outlet said. Minnesota, which is not on West's list, said its appellate courts' data was exposed too, per the outlet. That puts the count at 12 states or more.

West says some court records could contain names, Social Security numbers, dates of birth and medical information, and that "certain confidential, redacted or sealed information may have been impacted" for some courts. On 31 August, the vendor told Ohio's Supreme Court the access took place on the production platform holding all filing-system data for 10 of its 12 courts of appeals, per Court News Ohio.

Minnesota said its exposed data came from backups the courts gave the vendor, per CBS News Minnesota. Alabama's appellate courts said West told them a copy of some of their data was kept in a backup file in West's cloud environment, The Hacker News reported. "This incident occurred within our vendor's systems, not our own," Alabama Chief Justice Sarah Stewart said, per the same outlet. The defender's timeline: three to four weeks from discovery to the 23–27 July court notices, per that outlet, and more than five weeks from Ohio's 24 July notice to word of its production platform, per Court News Ohio.

• Inventory every copy of case data a vendor holds, backups included.
• Require vendor access logs that cover backups and storage, not only the application.
• Segment sealed and confidential material from shared vendor environments.

FORGE — Investigations is designed for the work that follows a vendor notice. FORGE CaseOps supports one case for legal, cyber and security staff, with an owner and deadline per notification task. FORGE Chain supports complete auditability: the notice and vendor correspondence enter as hashed evidence, with every access and transfer logged. Counsel and investigators judge the exposure; FORGE is designed to keep the record.

As with the ransomware campaign that went after engineering data, the exposure ran through software many organizations share. A vendor notice tells you what the vendor knows. Legal and investigations teams should know which copies of their data a vendor holds before that notice arrives.