Thomson Reuters detects cybersecurity incident, says unauthorized party accessed files

Thomson Reuters

03/09/2026 04:02

Sept 2 (Reuters) - A unit of Thomson Reuters detected a cybersecurity incident in 11 U.S. states, the U.S. Virgin Islands and Canada on June 30 involving the company's C-Track case management platform, according to a notice from the company on Wednesday and a statement by the chief justices of three Ontario courts, which use the platform for digital court record management.
A subsequent investigation by Thomson Reuters found that an unauthorized party obtained certain C-Track files in March, the company said on a website created to provide information about the incident. The company's investigation found some court records were "affected" and they included names and personal information, the website said.
A website set up by the West Publishing unit of Thomson Reuters to answer questions about the hack said it hit court systems in Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire, Wyoming and the U.S. Virgin Islands.
The statement from the chief justices of the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice said Thomson Reuters detected unauthorized activity in one of its cloud environments, and had taken steps to contain the activity, working with Ontario's Ministry of the Attorney General and the courts.
"We are advised that Thomson Reuters responded by taking steps to contain the activity, engaging external cybersecurity experts to advise and investigate, notifying law enforcement, and securing the C-Track environment," the statement said.
Toronto-based Thomson Reuters confirmed that it took containment and security steps and that affected customers have been notified.
"There has been no operational disruption to C-Track as a result of this incident," a Thomson Reuters spokesperson said. "Our products and services remain fully operational and are safe to continue to use. Independent cybersecurity experts assisted in the investigation and validated the remediation measures implemented."
It is unclear what information may have been compromised, the chief justices' statement said. They said that individuals involved in court proceedings or mentioned in court documents could have had personal information relating to them involved in the incident.
Reuters could not independently determine who was responsible for the incident or specific details about the information that was compromised. Reuters News is a division of Thomson Reuters.
The chief justices' statement said Thomson Reuters Canada would respond to all inquiries and would set up a call center that will be active on September 4. The Thomson Reuters spokesperson confirmed the company was responding to inquiries in the U.S. and Canada and will have a contact center.

 (Reporting by Kenneth Li and Chris Sanders; Editing by Edmund Klamann)