One click on a bad link was enough. According to the Arizona Supreme Court, a court employee opened a phishing email, and criminal hackers then copied backup files holding some of the most sensitive records the state’s judiciary keeps.
The breach is still being investigated, and the number of people affected has grown as the court has released updates.
What the court says happened
Chief Justice Ann Scott Timmer announced the attack on 25 September.
The court said it was targeted by “criminal hackers or their bots.”
Reporting based on the court’s alert says
the intrusion appears to have started on Thursday, 24 September, at about 11:30 a.m., after the employee clicked the link.
The same account says court IT staff shut the attack down less than two hours after identifying it.
By then, some data had already left the network.
The attackers copied backup files containing records related to protective orders and foster care cases.
Protective orders are sought by people who fear for their safety, which is why the exposure worries advocates and those affected.
A second dataset came to light days later.
On the Monday after the announcement, the court said hackers had also reached reports prepared by the Foster Care Review Board
, a citizen panel that reviews cases involving children in foster care.
More than 150,000 of its recommendation reports, going back to 2010, were copied.
A wider pool of people
Fox 10 Phoenix reported that
the breach has potentially exposed the personal information of more than 1 million people in a court debt collection program.
That figure is described as potential exposure, not confirmed theft of each person’s data.
One woman who received a notice on 25 September about a past protective order told the station that people who seek such orders are already looking for help and already worry about their safety.
The court says it has notified the Arizona Department of Child Safety, attorneys for parents and children in dependency cases, juvenile court judges and review board members.
What is not known
- Who did it. Malwarebytes reportsthe case is under investigation with the FBI, and no ransomware group has publicly claimed responsibility.
- Whether the data has spread. The court says it has no evidence the information has been shared. It is also unclear how much of the copied data is easy to read.
- Who else is affected. So far the court has found no evidence that information on jurors, witnesses or court employees was in the copied files.
Check Point’s weekly threat report on 5 October listed the Arizona case among the top attacks and breaches of the week, a sign the story is still developing.
What readers can do
If you get a notice from the Arizona courts, treat it as genuine only after checking it through the court’s official website or phone line, not through links in the message. Breaches like this tend to be followed by scammers posing as the affected organisation.
- Be wary of follow-up messages. Unexpected emails or calls about “your court case,” fines or “verifying your identity” may be fraud. Do not click links or give details.
- Freeze your credit. In the US, a freeze with the three credit bureaus is free and blocks most new-account fraud.
- Watch your accounts. Review bank and card statements, and consider an identity-protection PIN for tax filing.
- Protect your location. If a protective order is involved, think about whether any address or contact details on file could now be known, and speak to a victim advocate about safety planning.
The lesson for organisations
The attack began with a single phishing email, and the damage came from what was stored in backups. Regular phishing drills, multi-factor authentication, limits on who can reach backup systems and alerts for large downloads all reduce the risk. Court IT staff spotted the unusual downloads and cut access quickly. Even so, the copying had already happened.
The court has set up an FAQ page on the incident. Affected people should expect notices by email or mail as the review continues.