The Arizona Judicial Branch says criminal hackers copied backup court files after a cyberattack that began on Thursday, September 24, and that about 1.3 million people referred to its debt-collection program are affected.
What happened
According to the court system’s cybersecurity alert page, the activity appears to have started around 11:30 a.m. on September 24, and court IT staff shut it down less than two hours after it was identified. The copied files cover three groups: records involving active and inactive protective orders, Foster Care Review Board recommendation reports, and individuals referred to the Fines/Fees and Restitution Enforcement (FARE) program.
For FARE, the data includes case numbers, names and Social Security numbers, copied from a backup server. The court puts the affected number at approximately 1.3 million individuals, with court debts dating back 30 years. It says no data on jurors, witnesses or court employees was copied, and no court records were deleted or altered.
What the court says it knows
The court has no evidence that any of the data has been accessed, is readable, or has been shared. It says the evidence so far suggests the attack began with a phishing email that a court employee clicked. The FBI and state law enforcement have been contacted. FARE notifications are going out by text message and as an alert on mailed collections notices, and the court encourages affected people to freeze their credit files with Equifax, Experian and TransUnion.
Why it matters
The court’s account puts a backup server at the center of the loss. Backups often keep records that production systems have already aged out, which is how one program can hold 30 years of debtors in a single place. CyberTech has covered other public-sector data losses, including Denmark’s CPR register incident and ANSSI’s report on the French tax breach. Our read: one phishing click reached a historical store, so teams should check which accounts and networks can reach their backup tier and how long it keeps data.
