A cyber-security incident involving Thomson Reuters’ C-Track platform has affected court systems across the US and Canada, highlighting how shared technology providers can concentrate sensitive information from many organisations.
A cyber-security incident involving Thomson Reuters’ C-Track platform has affected court systems across the US and Canada, highlighting how shared technology providers can concentrate sensitive information from many organisations.
C-Track is used to manage court filings and digital case records. Thomson Reuters detected unauthorised activity in one of its cloud environments on 30 June and subsequently found that an unknown party had obtained certain files in March.
The incident affected court systems in 11 US states, the US Virgin Islands and Ontario, according to Reuters. The records included names and personal information, although the full scope of the exposure was still being assessed.
There was no operational disruption to C-Track, which remained available throughout the response. That distinction matters: availability is only one measure of security. A service can continue functioning normally while the confidentiality of the data it holds has already been compromised.
The Supreme Court of Ohio said the unauthorised access affected the production platform holding filing data from 10 appellate courts. It had not yet determined whose personal information was exposed and said it was awaiting comprehensive details of the security measures introduced by the provider.
Shared platforms can improve efficiency and reduce the technical workload carried by individual public bodies. However, they can also bring records from multiple jurisdictions into one environment, increasing the potential reach of a single incident.
Risk and procurement teams should establish where suppliers store production, backup and troubleshooting data, who can access it and how quickly customers will be notified after suspicious activity is detected. Contracts should also provide enough information for affected organisations to meet their own notification duties.
The absence of an outage should not be mistaken for the absence of harm. When a common supplier holds sensitive records for multiple institutions, a quiet breach can have consequences far beyond the system in which it began.
