Thomson Reuters Hack Exposes SSNs, Medical Data

An extensive security breach at Thomson Reuters impacted cloud infrastructure hosting the C-Track system between March and late June 2026. The intrusion, which went unnoticed for approximately four months, led to unauthorized access to files associated with appellate court systems in 12 US states, the US Virgin Islands, and three courts in Ontario, Canada. The compromised data potentially includes names, Social Security numbers, driver's license numbers, dates of birth, medical information, and health insurance details. Some jurisdictions expressed concern that even sealed or redacted documents might have been exposed.

The public was notified on September 2, 2026, following detection on June 30, 2026, and notification to individual courts between July 23 and July 27, 2026. This five-month delay between initial intrusion and public disclosure was attributed by Thomson Reuters to a need for coordinated announcements. To mitigate the impact, the company is providing 12 months of free credit monitoring services through Experian IdentityWorks in the US and TransUnion myTrueIdentity in Canada, with enrollment open until December 31, 2026. Standard advice to freeze credit and remain vigilant against phishing attempts is also recommended, with a US hotline available for inquiries.