Hackers breached Arizona’s court system network in September 2026 after a phishing email tricked an employee into clicking a malicious link. The attack exposed records for 1.3 million people with unpaid court fines, plus protective orders and foster care reports. No misuse has been confirmed yet. Affected individuals should monitor credit reports and consider a credit freeze immediately.
| Company | Arizona Court System |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Personal Identifying Information, Court Fee and Fine Payment Records, Orders of Protection Records, Foster Care Board Reports |
| People Affected | 1.3 million individuals |
| Attack Method | Phishing/Unauthorized Network Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Arizona Court System Data Breach?
The Arizona court system recently confirmed that hackers broke into its network and stole personal data belonging to more than a million people. The unauthorized access to its network occurred in September 2026. As a result, officials have spent the weeks since then notifying affected individuals and working to understand the full scope of the intrusion.
According to the Arizona Supreme Court, the attack is believed to have started when a court employee clicked a malicious link in an email. This type of phishing attack is a common entry point for cybercriminals. Once inside the network, the attackers were able to access and copy sensitive records before court technology staff detected the activity.
Court staff shut down the attack on a backup server about two hours after first spotting it. Because the response was quick, officials say no records were altered or deleted during the incident. The attack is still under investigation, and the court has stated it has no evidence the stolen data has been used or shared since the breach occurred.
Importantly, the court has said the cyberattack has not affected or delayed any ongoing court cases. This suggests the intrusion was largely contained to data storage systems rather than active case-processing infrastructure. Even so, the sheer volume of records taken makes this one of the more significant breaches involving a US government court system in recent memory.
Who was affected?
Multiple distinct groups of people appear to be affected by this breach. The largest group includes 1.3 million individuals with unpaid court fees, fines, and restitution payments tied to traffic and criminal violations. Remarkably, some of these records date back as far as 30 years, meaning people who had court involvement decades ago could still be impacted today.
In addition, the attackers accessed records for two other groups. This includes nearly 30,000 active and inactive orders of protection, which often involve sensitive details about domestic violence or safety concerns. The attackers also took around 150,000 reports from a foster care board dating back to 2010, which make recommendations in cases involving parents alleged to be unfit or unable to care for a child.
Because foster care reports often involve children and vulnerable families, this aspect of the breach raises particular concern. Minors may be indirectly affected if their family’s case records were involved. The court has clarified, however, that information about jurors, witnesses, and court employees was not stolen in this incident.
Given the broad timeframe covered by these records, the affected population likely includes people across many different life circumstances. Some may have fully resolved their court matters years ago and have no ongoing relationship with the legal system today. As a result, many affected individuals may be surprised to learn their information was still stored and vulnerable.
What Information Was Potentially Exposed?
The data stolen in the Arizona court system data breach varies depending on which court records were involved. Based on the categories described by the court, affected individuals should assume their records may include the following types of information.
- Personal identifying information tied to traffic and criminal violation records
- Details related to unpaid court fees, fines, and restitution payments
- Information connected to active and inactive orders of protection
- Foster care board reports involving family court recommendations
Although the court has not published an itemized list of every data field involved, records like these commonly include full names, case numbers, and financial payment details. For orders of protection and foster care reports, the exposure may also involve sensitive circumstances describing personal or family conflict. This kind of information is far more sensitive than a simple name-and-address leak.
Because financial payment histories were involved, affected individuals face some risk of identity theft or fraud. For example, criminals could potentially use stolen personal details to open fraudulent accounts or file false tax returns. Therefore, anyone with unpaid court fees or fines in Arizona should treat this breach seriously, even if their case closed long ago.
The exposure of protective order and foster care records creates a different, more personal risk. In these cases, exposure could lead to unwanted contact, harassment, or further privacy violations for people already dealing with difficult legal circumstances. Consequently, individuals connected to these specific record types may want to take extra precautions beyond standard identity theft monitoring.
What is the company doing?
Once the court’s technology staff identified the intrusion, they moved quickly to shut it down. The response took place within about two hours of detection, which likely limited further data loss. Since the breach occurred, the Arizona Supreme Court has also begun notifying those affected, consistent with its public disclosure.
State Supreme Court spokesperson Alberto Rodriguez has stated that there is currently no evidence the stolen information has been used or shared. However, the investigation into the attack remains ongoing. This means additional details could emerge as officials continue their forensic review of the incident.
So far, the court has reported that no case records were altered or deleted during the attack. This is a positive sign for the integrity of the court’s broader case management system. Nevertheless, affected individuals should stay alert for further updates as the investigation progresses.
What Should Affected Individuals Do?
Monitor Your Credit Reports Regularly
Anyone affected by this breach should begin checking their credit reports for unusual activity. This includes watching for new accounts, unexpected credit inquiries, or unfamiliar charges tied to your name. You can request free credit reports from each of the three major credit bureaus on a rotating basis throughout the year.
Because some of the exposed records involve financial payment histories, this step is especially important. Regular monitoring helps you catch fraudulent activity early, before it causes lasting financial damage. If you notice anything suspicious, report it to the credit bureau and consider placing a fraud alert immediately.
Consider a Fraud Alert or Credit Freeze
Given the financial nature of some exposed records, affected individuals should strongly consider placing a fraud alert or credit freeze on their accounts. A fraud alert requires creditors to verify your identity before opening new credit in your name. A credit freeze goes further, blocking most new credit applications entirely until you lift it.
Both options are free and can be requested directly through the major credit bureaus. While a freeze offers stronger protection, it also requires you to temporarily lift it whenever you apply for new credit yourself. Either way, these tools provide an added layer of defense while the investigation into this breach continues.
Stay Alert for Phishing Attempts
Because this breach reportedly began with a phishing email, affected individuals should be extra cautious about suspicious messages. Scammers often use information from data breaches to craft convincing follow-up phishing attempts. For example, a fake message referencing your actual court case details could appear far more legitimate than a generic scam email.
As a result, you should avoid clicking links or downloading attachments from unexpected emails, even if they appear to reference real court matters. Instead, contact the Arizona court system directly through verified phone numbers or official websites if you have questions. This simple habit can prevent a secondary attack from succeeding.
Protect Sensitive Family and Safety-Related Records
If you have an order of protection or are connected to a foster care case affected by this breach, additional caution is warranted. Consider reviewing your personal safety plans and being alert to any unusual contact from unknown parties. In addition, you may want to inform trusted family members or advocates about the situation.
Because this type of exposure involves sensitive personal circumstances rather than just financial data, the risks can feel more immediate. If you experience any harassment or unwanted contact that you believe may be connected to this breach, document it and report it to local law enforcement. You may also benefit from speaking with a data breach attorney about your legal options.
Consult a Data Breach Attorney
Given the scale and sensitivity of this breach, affected individuals may want to speak with an attorney who focuses on data breach cases. Many offer free consultations to help you understand whether you qualify for compensation. This is especially relevant given the large number of people affected and the sensitive nature of some records involved.
An attorney can also help you understand your rights under Arizona law and any applicable deadlines for taking legal action. Because these deadlines can vary, it’s worth seeking guidance sooner rather than later. A free case evaluation carries no obligation and can clarify your options quickly.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.