Thomson Reuters C-Track Breach Exposes Sensitive Personal Info

Thomson Reuters has revealed that unauthorized activity on its C-Track platform, a court case management system used in 12 US states and Canada, exposed sensitive personal information and court records for thousands of individuals. The breach occurred on June 30, 2026, affecting at least 12 US states, the U.S. Virgin Islands, and Canada. According to reports, Thomson Reuters launched an investigation with outside cybersecurity experts and law enforcement, and notification pages were published for affected individuals in the US and Canada.

The breach on the C-Track platform is believed to have occurred due to a vulnerability in the system's security measures. An investigation by Thomson Reuters with outside cybersecurity experts has found that an unauthorized party obtained C-Track files in March, more than three months before the discovery of the breach itself. The specific details of how this happened are still unknown, but it is reported that the unauthorized party had access to sensitive personal information and court records for a period of time before being detected. No information is available on the identity of the unauthorized party involved.

Notification pages have been published for affected individuals in the US and Canada, but many questions remain unanswered. What information was accessed by the unauthorized party? How did it manage to evade detection for over three months? And what steps will be taken to ensure that such a breach never happens again? Thomson Reuters has promised to cooperate fully with law enforcement, but the public is left waiting for answers as the investigation continues.

The investigation into the breach is ongoing, with Thomson Reuters cooperating fully with law enforcement. However, the lack of information on the identity of the unauthorized party involved has raised concerns among some experts, who have called for greater transparency and accountability from the company.