One phishing click let attackers copy over 150,000 foster-care reports from Arizona court backups
Arizona's Supreme Court says attackers copied over 150,000 foster-care review reports dating to 2010 from backups after an employee clicked a phishing link. The court kept those copies to recover from ransomware, so the store meant to survive an attack is the one that leaked.
The Watch · Security desk
What happened
- The stolen reports can include children's information, names of involved parties, case materials, board findings, and recommendations to courts, parents and the Department of Child Safety.
- According to the court, the foster-care reports do not contain addresses or telephone numbers.
- The court says it has no evidence so far that data on jurors, witnesses or court employees was in the copied files.
- The court has not identified the attackers or a motive and is investigating the case with the FBI.
Why it matters
- Who's exposed exposure Protective-order records put abuse victims most directly at risk, since Malwarebytes says combining names, case details and locations can expose people trying to keep away from an abusive or threatening person.
- Who has to decide decision Agencies holding ransomware-recovery copies of sensitive records have to decide whether those stores get production-level access controls and exfiltration monitoring, because in Arizona the backup copy is what the attackers took.
- Who's exposed exposure People notified of the breach become targets for follow-on phishing from impersonators posing as the Arizona Supreme Court or another agency, Malwarebytes warns.
Next story · Security · Oct 1
Arizona's court system says hackers copied residents' data without deploying ransomwareConfirmed2 publishers
The attack began when a court employee clicked a malicious link in a phishing email [2]. It ended with the attackers copying backup files that held protective-order and foster-care records [3]. The court's account does not say how they got from one inbox to the backup store, or what protected the files once they were there.
The copied files were stored in a highly compressed format and kept for recovery after ransomware and other destructive incidents [10]. Backups kept for that purpose hold the same records as the systems they protect. Guarding a backup against deletion is one control. Guarding it against being read is a different one.
More than 150,000 Foster Care Review Board recommendation reports were copied [6]. According to the court, about 8,000 children are in Arizona foster care today [14]. That works out to roughly 19 reports for every child now in care [16]. The reports cover past cases as well as current ones, going back to 2010 [6]. The exposed set includes families whose cases have closed.
The court's announcement said "Arizona's court system was targeted by a cyber attack from criminal hackers or their bots." [1] No ransomware group has publicly claimed responsibility [5]. For now, everything public about the intrusion comes from the court's own statements. The court says it has no evidence the data has been shared [11]. Malwarebytes, which reported the breach, wrote that this can change as investigators work out exactly what was taken and watch for publication, sale or misuse [13].
What to watch
- Whether the court discloses how the attackers moved from the phished employee's machine to the backup store, and whether the backup files were encrypted.
- Any leak-site post, sale listing or extortion demand involving the foster-care or protective-order data.
- A count and description of the protective-order records in the copied backups.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap−20
- Incentives35
- Confidence72
Perspective Coverage
6 publishers- Builder
- Builder 24%
- Operator
- Operator 68%
- Investor
- Investor 8%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Arizona's court system was targeted by a cyber attack from criminal hackers or their bots.
- [2]
The court says the attack began with a phishing email containing a malicious link that a court employee clicked.
- [3]
The attackers copied sensitive backup files containing records related to protective orders and foster care cases.
- [4]
The court has not identified the attackers or a motive, and says the case is under investigation with the FBI.
- [5]
No ransomware group has publicly claimed responsibility for the attack.
- [6]
The attackers copied more than 150,000 recommendation reports created by Arizona's Foster Care Review Board, covering current and past cases involving children's care and protection, dating back to 2010.
- [7]
The court says it has no evidence, so far, that information about jurors, witnesses, or court employees was included in the copied files.
- [8]
The reports can include information about children, names of involved parties, case materials considered by the board, findings, and recommendations for courts, parents, and the Arizona Department of Child Safety.
- [9]
The court says the reports do not contain contact information such as addresses or telephone numbers.
- [10]
The copied files were backups stored in a highly compressed format, kept for recovery after ransomware and other destructive incidents.
- [11]
The court currently says it has no evidence that the information has been shared.
- [12]
Cybercriminals may contact affected people posing as the Arizona Supreme Court, another government agency, or someone they know.
- [13]
The court's finding that data has not been shared can change as investigators determine exactly what was taken and monitor for publication, sale, or misuse of the data.
- [14]
Arizona has about 8,000 children currently in foster care, according to the court.
- [15]
Even where some protective-order records are public, combining names, case details, locations, and other sensitive context could create risks for people trying to limit their exposure to an abusive or threatening individual.
- [16]
The copied Foster Care Review Board reports number roughly 19 for every child currently in Arizona foster care.
Sources
6 independent publishers whose own reporting we read for this story.
- cyberinsider.comArizona court suffered data breach exposing 1.3 million people
1 article · October 7, 2026
- malwarebytes.comHackers steal protective order and foster care records from Arizona courts
1 article · September 30, 2026
- news.bloomberglaw.comArizona Court Cyberattack Exposes Data on 1.3 Million People
1 article · October 6, 2026
- securityweek.comPersonal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
1 article · October 6, 2026
- techradar.comArizona court system hack leads to theft of personal data belonging to 1.3 million Americans | TechRadar
1 article · October 7, 2026
- therecord.mediaArizona courts say hackers stole info on more than 1.3 million people
1 article · October 7, 2026
Topics and entities
Topics
- Court system cybersecurity
- Phishing
- Data Breaches
Entities
- Fines/Fees and Restitution Enforcement Program
- Arizona Foster Care Review Board
- Arizona Department of Child Safety
- Federal Bureau of Investigation
- Ann Scott Timmer
- Arizona Supreme Court