On 2 September 2026, West Publishing Corporation — the Thomson Reuters unit behind the C-Track court case management platform — issued a breach notice covering courts in a dozen US jurisdictions, the US Virgin Islands and three courts in Ontario.

The dates are the first thing to read. Unauthorised access ran from 1 March to 29 June 2026. West Publishing discovered it on 30 June. The notice went out on 2 September.

That is roughly 120 days inside before anyone noticed, and another 64 days between noticing and telling anyone.

What the notice says was taken

In the notice's own words, the records could contain "names along with one or more of the following: Social Security numbers, driver's license numbers, medical information, dates of birth, and health insurance information."

And then the sentence that makes this different from the week's other breaches:

"Confidential, redacted, or sealed court information may also have been affected."

Credit monitoring cannot re-seal a record

West Publishing is offering 12 months of credit monitoring — Experian IdentityWorks in the US, TransUnion myTrueIdentity in Canada — with enrolment open until 31 December 2026 and a hotline on 1-833-918-5294.

For the Social Security numbers, that is the standard remedy and it is fine as far as it goes.

For the sealed records it is not a remedy at all. A court seals a record by order: to protect a domestic violence complainant's address, an informant's identity, a juvenile's history, a defendant whose charges were dropped. The seal is a legal instrument enforced against people who can be reached by a court. It has no effect on a copy in someone else's hands.

You can freeze a credit file. You cannot un-disclose an address that a court ordered withheld, and no amount of monitoring tells you whether it has been used.

The exact scope of the sealed material has not been published.

Two courts describe two different things

Here the public record disagrees with itself, and it is worth naming rather than smoothing over.

Montana's court statement describes the intrusion as reaching backup data stored on Thomson Reuters servers, drawn from database copies supplied to Thomson Reuters for the purpose of troubleshooting the applications.

Ohio reported the breach occurred on the production platform itself.

Those are not the same incident description. They may both be true — a single cloud environment can hold production data for one customer and troubleshooting copies for another — but nobody has said so, and the difference matters enormously for any given court trying to work out what of theirs was exposed.

If Montana's characterisation is the general case, the sharper problem is the copy: a database handed to a vendor to debug an application is a full-fidelity duplicate that exists outside whatever controls the court applies to production, retained for as long as the ticket stayed open and possibly longer. We keep arriving at the same shape from different directions — the thing that gets breached is rarely the system anybody drew on the architecture diagram.

The list disagrees with itself too

Named in the notice: Alabama appellate courts, Kentucky appellate courts, the Montana Supreme Court, Nevada appellate courts, the New Hampshire Supreme Court, the North Dakota Supreme Court, Ohio's district courts of appeals (First through Twelfth), multiple Pennsylvania courts, South Carolina's Supreme Court and Court of Appeals, the Tennessee Appellate Court Clerk's Office, the entire Wyoming judicial branch, the US Virgin Islands Supreme and Superior Courts, and the Court of Appeal for Ontario, Ontario Superior Court of Justice and Ontario Court of Justice.

Two things about that list.

Oregon's appellate courts were confirmed separately rather than in the notice. Minnesota reported exposure despite not appearing in it at all. Different outlets have counted 11 states and 12 states from the same document.

A notice that jurisdictions have to correct by hand is a notice that is still being assembled in public. If your court is not on it, that is not yet evidence of anything.

The other thing: this is overwhelmingly appellate courts and state supreme courts. Appellate records carry the full trial history — the sealed exhibits, the suppressed evidence, the sentencing material — which is the part of the file that was never meant to be read outside the courtroom.

What Thomson Reuters chose to say

The company's public reassurance is that there has been "no operational disruption to C-Track as a result of this incident" and that it considers the platform "safe to keep using". It says it has found no evidence of fraud or misuse.

Both statements are probably accurate. Neither is responsive.

Nobody asked whether the docket system stayed up. The incident is a confidentiality failure, and "no operational disruption" is an availability answer. "No evidence of misuse" is the standard formula, and for sealed records misuse does not look like a fraudulent credit application — it looks like a name reaching a person who was ordered not to have it, and it generates no evidence at all.

Several affected courts have terminated Thomson Reuters' access. North Dakota has confirmed an active criminal investigation.

What to do

  • If you are a court on that list, treat the sealed material as a separate incident. The identity-theft response and the sealed-records response are different problems with different affected people and different legal obligations.
  • If you are a court not on the list, ask anyway. Minnesota and Oregon are the reason.
  • Inventory the copies, not the systems. Ask every vendor what production data they hold outside production, why, and when it gets deleted. Montana's description is the entire lesson.
  • If you were a party to a sealed proceeding, you will not be told directly. No individual notification scheme covers "the fact of your sealing may be known".
  • Enrolment closes 31 December 2026. That is a real deadline on the one remedy actually offered.

What is not established

  • How the intruder got in. Not stated.
  • Who. Not stated, and under active investigation.
  • How many people. No total has been published.
  • Which sealed records, and how many. The notice says the category was affected and does not scope it.
  • Whether Montana's description or Ohio's applies to any given court.