Hackers copied personal data on 1.3 million people who owe unpaid court fees, fines or restitution in Arizona, with records going back as far as 30 years. The Arizona Supreme Court disclosed the scale on Oct. 6, 2026, about two weeks after court technology staff spotted the intrusion on Sept. 24 and shut it down in roughly two hours.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The same attack also reached nearly 30,000 orders of protection and 150,000 foster care board reports, which means the stolen material goes well beyond traffic tickets. The court says it has found no evidence so far that any of it has been used or shared, and officials say they are withholding some details to protect both the investigation and the people affected. The FBI is investigating, and the court says it is contacting as many affected people as it can.
What was copied, and from where
According to the Associated Press account carried by azfamily, the largest group is 1.3 million people with unpaid court fees, fines and restitution from traffic and criminal cases. The attackers also took records of nearly 30,000 active and inactive orders of protection, and 150,000 reports dating back to 2010 from a foster care board that recommends actions in cases where parents are alleged to be unfit or unable to care for a child.
The court’s own cybersecurity alert page adds detail. The fines data comes from the court’s FARE collections program and includes case numbers, names and Social Security numbers, although it was taken from a compressed backup and the court says it is unclear whether most of it is readable. The foster care reports hold case and child information, the names of interested parties, statements, findings and recommendations, but no addresses or phone numbers. About 8,000 children are currently in foster care, the page says.
An employee click and a backup server
The attack is believed to have started when a court employee clicked a malicious link in an email. The alert page puts the start at about 11:30 a.m. on Thursday, Sept. 24, and says criminal hackers accessed and copied backup court files on a backup server, and Chief Justice Timmer said the court wants to minimize the chance that the stolen information could be used to jeopardize Arizonans further. No court records were deleted or altered, court dates and orders are unaffected, and information on jurors, witnesses and court employees was not copied.
Chief Justice Ann Scott Timmer announced the attack the next evening in a news release that said court leaders believed attackers had copied personally identifiable information about many Arizonans. She said she had spoken personally with the top-ranking FBI official in Arizona. Days later, she told azfamily the early picture was thin, with large chunks of data the extent of what was known at that point. She described the activity as appearing to be some type of automated bot that went in and started hitting particular files, though it was unknown whether the targeting was random or deliberate.
Domestic violence and foster care records
The orders-of-protection records drew the sharpest concern. In azfamily’s earlier report, names and addresses of people holding such orders appeared to be among the copied data. Jenna Panas, CEO of the Arizona Coalition to End Sexual and Domestic Violence, said people with these orders typically have reasons to keep their address and name protected, since the orders exist to shield them from people who harm, harass or stalk them. One woman holding an order of protection said that reading her information may have been copied “made me feel very vulnerable.”
Court spokesperson Alberto Rodriguez said Tuesday, Oct. 6, that the court has no evidence the stolen data has been used or shared since the attack. Rodriguez added that the investigation is continuing and that the attack has not affected or delayed any court cases. The court also contacted domestic violence shelters and advocacy groups for guidance, according to the earlier report.
What affected people are told to do
The court says it has notified those affected, and that official notices come only from its email address or from text messages sent from short code 83958; notices may also arrive by mail. People can check whether their information was accessed through a lookup the court links from its alert page. For those in the fines program, the court encourages placing a hold or freeze on credit files with Equifax, Experian and TransUnion, and points to the federal IdentityTheft.gov site and the Arizona attorney general’s data breach page.
The court states plainly that the notices are “not a scam,” which matters because breach disclosures invite imitation. The fines records reach back as far as 30 years, so notices may reach people about cases from long ago. Questions go to the Arizona Courts Help Desk at 602-452-3519 or 800-720-7743, Monday to Friday, 7 a.m. to 6 p.m. SecurityWeek’s rewrite of the AP story confirms the same core figures and the same account of the employee click.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
