MN court data breach: Private user data exposed after third-party vendor hacked

MINNEAPOLIS (FOX 9) - Personal data within Minnesota court systems, as well as several other states, was exposed after a third-party vendor used to process caseloads was breached. 

C-Track court management breach 

Big picture view:

Minnesota uses a third-party vendor, C-Track, which is provided by Thomson Reuters, to manage and process court case filings. 

State officials say case documents, such as orders and briefs, were not included in the security breach. 

A spokesperson for the Minnesota Judicial Branch said most court case information is public, but some case data contains private information.

The affected data could potentially include user's names along with one or more of the following: Social Security numbers, driver's license numbers, medical information, dates of birth and health insurance information. Certain confidential, redacted or sealed information may also have been impacted by some courts.

In response, the Minnesota Judicial Branch said it terminated Thomson Reuters' access to the courts' electronic environments, audited accounts and began consulting tech experts along with state authorities. 

The breach was also reported to law enforcement. 

Timeline:

Thomson Reuters said On June 30, 2026, C-Track discovered unauthorized activity involving certain files by a third party. 

That investigation found that in March 2026, an unauthorized party obtained certain C-Track files.

Dig deeper:

The investigation found that the unauthorized party also obtained files tied to appellate courts in Alabama, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, New Hampshire, Wyoming and the U.S. Virgin Islands, along with multiple Ohio appellate courts and several Pennsylvania courts, including the Environmental Hearing Board, the Court of Common Pleas of Monroe County, the Court of Common Pleas of Washington County, and the Fifth Judicial District.

What they're saying:

Minnesota Supreme Court Chief Justice Natalie Hudson shared the following statement:

"Since we learned about this incident, we have been working with Thomson Reuters and the Branch’s internal cybersecurity experts to conduct a full investigation to understand the root cause and the scope of the breach. I am deeply troubled that our court users’ data has been compromised and want to assure you we will do everything possible to get to the bottom of this and ensure your information remains safe."

C-Track says there is no evidence that systems used to process financial transactions were impacted, and no evidence that the breach has led to any fraud or misuse of information to date.

What's next:

Users of the appellate courts' case management system have been notified that they must change their passwords. Anyone who tries to log in with a previous password will be locked out of the system. C-Track says it has implemented additional security measures to help prevent a similar situation in the future and is offering complimentary credit monitoring and identity theft protection services to affected individuals.

What you can do:

Anyone with questions about the breach can reach out to Minnesota Judicial Branch officials via TRQuestions@courts.state.mn.us.

C-Track is also offering assistance to anyone who calls 1-833-918-5294 and provides the engagement number B171847.

TechnologyMinnesotaCrime and Public Safety