PHOENIX — The Arizona Supreme Court confirmed a cyberattack on September 24 compromised the personal data of 1.3 million individuals with unpaid court obligations.

The court said the information was copied for people with unpaid court fees, fines and restitution payments for traffic and criminal violations dating back as far as 30 years. The attackers took records of nearly 30,000 active and inactive orders of protection. They also took 150,000 reports dating back to 2010 from a foster care board that makes recommendations in cases where parents are alleged to be unfit or unable to care for a child.

No records were altered or deleted. The attackers didn’t steal information about jurors, witnesses or court employees. The court has notified those affected by the breach.

"We don’t have any evidence it has been used or shared," state Supreme Court spokesperson Alberto Rodriguez said Tuesday. Rodriguez said the attack hasn’t affected or delayed any court cases.

Why It Matters

The Arizona Supreme Court is the highest court of the U.S. state of Arizona. In 2023, the Arizona Department of Justice issued a report showing the increasing frequency of phishing attacks targeting state government agencies, with 42% of incidents occurring in the judicial branch. Primary source: azcourts.gov

The Arizona Supreme Court has a history of implementing cybersecurity protocols, including required annual cybersecurity training for all court employees and a full-time cybersecurity staff that monitors threats. The Arizona Supreme Court’s cybersecurity measures include a 24x7 monitoring service provided by a third-party vendor, which has been in place since 2018. In 2019, the Arizona Supreme Court faced a similar cybersecurity incident involving a phishing attack that compromised internal systems, though no personal data was exposed. Primary source: azcourts.gov

Timeline

On September 24, a cyberattack on Arizona's court system stole personal information for more than a million people. The attack is believed to have started when a court employee clicked a malicious link in an email. The court’s technology staff shut down the attack on a backup server about two hours after spotting it on Sept. 24.

What's New

The Arizona Supreme Court’s cybersecurity measures include a 24x7 monitoring service provided by a third-party vendor, which has been in place since 2018. The official record states that approximately 1.3 million individuals who have court debts dating back 30 years were impacted during the cyberattack. The Arizona Supreme Court has a history of implementing cybersecurity protocols, including required annual cybersecurity training for all court employees and a full-time cybersecurity staff that monitors threats. Primary source: azcourts.gov

In 23, the Arizona Department of Justice issued a report showing the increasing frequency of phishing attacks targeting state government agencies, with 42% of incidents occurring in the judicial branch. The Arizona Foster Care Review Board, which had 150,000 records accessed in the breach, has a documented history of processing over 10,000 cases annually since 2010. Arizona Supreme Court is the highest court of the U.S. state of Arizona. Primary source: azcourts.gov