Arizona Judicial Branch and FBI Investigate Court Data Breach Exposing Millions of Records

PHOENIX, Ariz. - The Arizona Judicial Branch and the FBI are investigating a data breach that exposed the personal information of more than one million people, according to Chief Justice Ann Timmer.

The breach also allowed an unknown actor to download foster care reports and orders of protection from state court systems.

"We've discovered at least 99 percent of what was downloaded," Chief Justice Timmer said. She said the breach began when a court employee clicked a malicious link that gave attackers access to the network.

Systems affected

Timmer said the hackers hit three areas of the court system: the FARE System, which the public uses to pay fines and restitution; the Foster Care Review Board; and orders of protection.

Timmer said the foster care reports contain the names of children and recommendations made by the board. She said those were ordinary documents, but the FARE System and the protection order information were not. Those records would need to be decoded before they could be read.

"Our assumption is that they will be able to read the names and match it to a Social Security number," Timmer said.

Concern for protection order victims

Timmer said the theft of protection order data was the most troubling part of the breach.

"For me, this is the worst thing. Even if it's improbable that something will happen, the idea that you're a victim that's come to the court for assistance, and now you have to worry about, will the person I'm trying to protect myself against have access to information of where I'm located? That's very distressing to everyone," Timmer said.

Timmer said the state has had no indication yet that any of the stolen data has been misused.

"Is it possible to read this, put it on the dark web? Yes, it is possible. I mean, is it probable? I don't know. There's a lot of steps," Timmer said.

Experts point to identity theft

Cybersecurity experts said the breach was likely financially motivated rather than aimed at foster children or crime victims.

"If it was a case of ransomware, the network would have actually been locked out and then you get a message asking for monies in order to restore access. That hasn't happened in this case. In this case, the information was taken," said Ian Marlow, of FITECH Consultants.

Marlow said the most likely outcome is that the stolen data will be used to commit identity theft.

"It's not just government agencies. Government agencies, companies, this is extraordinarily common," Marlow said.

What to do

Marlow and the Arizona Judicial Branch both said anyone affected by the breach should freeze their credit and monitor their accounts. The state is now offering to pay for credit monitoring.

Timmer said the courts have texted and emailed people affected by the breach to notify them of what happened.