US
Hackers stole personal data on 1.3 million people from Arizona's court system after one phishing click
The breach exposed records tied to unpaid fines going back 30 years, nearly 30,000 protective orders and 150,000 foster care board reports. Officials say there's no sign the data has been used.
A cyberattack on Arizona's court system exposed personal information belonging to more than a million people, and officials believe it began when a court employee clicked a malicious link in an email.
The Arizona Supreme Court said the attackers copied information on 1.3 million people with unpaid court fees, fines and restitution payments for traffic and criminal violations dating back as far as 30 years.
Sensitive records taken
The attackers also took records of nearly 30,000 active and inactive orders of protection, along with 150,000 reports dating to 2010 from a foster care review board that makes recommendations in cases where parents are alleged to be unfit or unable to care for a child.
The court's technology staff shut down the intrusion on a backup server about two hours after spotting it on Sept. 24. The court has since notified people whose information was affected.
"We don't have any evidence it has been used or shared," state Supreme Court spokesperson Alberto Rodriguez said Tuesday. No records were altered or deleted, and the attackers did not take information about jurors, witnesses or court employees.
Why it matters
Advocates for domestic violence survivors say protective order records are among the most sensitive files a court keeps, because they can include addresses and details about people trying to stay safe from an abuser. Foster care files can include private details about children and families during some of the hardest moments of their lives.
The breach is also a reminder of how often large attacks begin with a single email. Phishing messages are designed to look routine, such as a shared document, an invoice or a password reset, and one click can give attackers a foothold inside a network.
What Arizonans can do
People who receive a notice from the court should read it closely and follow its instructions. Security experts generally recommend:
Placing a free credit freeze with Equifax, Experian and TransUnion, which blocks new accounts from being opened in your name.
Watching bank and credit card statements for unfamiliar charges.
Being wary of calls, texts or emails that mention court fines or case numbers and demand payment, since scammers may try to exploit the breach.
Contacting the court directly, using a phone number from its official website, to confirm any request that seems unusual.
Survivors with protective orders who are worried about their safety can contact a local domestic violence program or the National Domestic Violence Hotline at 800-799-7233 for help with safety planning.