Thomson Reuters tells courts that attackers took C-Track case data in several states

The containment line Kentucky drew is real, but it is narrow. It holds for a reason other states may not share. Trial-level records are outside the blast radius because Kentucky does not use third-party vendors for trial court e-filing, so only material that reached the Supreme Court or the Court of Appeals was sitting inside C-Track ^[3][12]. That reflects Kentucky's own procurement choices, not something specific to the breach itself. A state that routes more of its docket through the same platform has more files to account for, and it will not know which ones until Thomson Reuters CMS finishes reviewing that court system on its own schedule ^[9].

The multi-state claim is the vendor's, relayed through Kentucky's Administrative Office of the Courts: an unauthorized third party accessed and obtained court data from C-Track systems in more than one state ^[4]. Take the vendor at its own word choice and Kentucky is one of at least three affected court systems, which puts a minimum of two other jurisdictions in scope ^[16]. None of them are named. Neither is a threat actor, an intrusion or discovery date, a category of exposed data, or any claim of the data by an extortion group ^[15].

What the disclosure does say about data type, it says through the remedy. Twelve months of credit monitoring and identity theft protection, funded by Thomson Reuters CMS, points toward personal identifiers moving, and not toward public appellate opinions being copied ^[8]. The AOC's position is that there is no indication Kentucky's data has been shared or distributed to anyone outside ^[5], and the courts stayed up throughout ^[6]. Read together, this is exfiltration with no observed publication so far, and the observation window belongs to the vendor.

That is the structural problem for every court on the platform. The file systems, the logs, and the per-court review are all on the vendor's side ^[2][9]. Kentucky's leverage is a demand for prompt resolution and swift notification ^[13] plus status briefings with the National Center for State Courts and contact with other affected states ^[14]. Thomson Reuters CMS has committed to covering all breach costs and to handling notification itself ^[11]. The company footing the bill is also the one setting the clock: it decides when anyone is told, and the total number of affected individuals or organizations has not been determined ^[10].

Mitigations have been implemented across affected jurisdictions, according to the company, which is also working with outside cybersecurity specialists and law enforcement ^[7]. That is the standard post-incident package and it says nothing about initial access. Until the per-court reviews produce state names and notification counts, "several states" is the entire public scope of this incident ^[4], and any judiciary running C-Track is inside it by default.