Arizona court hack exposed data on 1.3 million people after one phishing click

On Thursday, September 24, someone got into the Arizona courts' network and started copying data from a backup server. The court's technology staff spotted it and shut it down about two hours later, the AP reports.

Chief Justice Ann Scott Timmer announced the attack the next day. In her statement, she said the court system was targeted by criminal hackers "or their bots," and that they copied personal information about "many Arizonans."

Over the following week, the court released more detail in stages:

• September 25: first announcement; the FBI is notified.
• September 28: the court discloses that foster care review reports were taken.
• September 30: it adds that names and Social Security numbers of about 1.3 million people were copied.
• October 6: the court tells the AP the attack hasn't affected or delayed any court cases.

There are three main groups of records, according to the court and the outlets that covered it.

• Court debt data: names, case numbers and Social Security numbers for about 1.3 million people referred to the FARE program, going back 30 years.
• Protective orders: records tied to nearly 30,000 active and inactive orders of protection, the AP reports. ABC15 says court officials put the number of people with protective orders who may be affected at about 170,000.
• Foster care reports: more than 150,000 Foster Care Review Board reports for current and past cases dating back to 2010.

FARE stands for Fines/Fees and Restitution Enforcement. It's the statewide program that collects unpaid court-ordered debt from civil traffic, criminal traffic and criminal cases. The court notes that people who were never sent to collections aren't in this data set.

What was not taken: the court says no records were deleted or altered. It also says there's no evidence that information about jurors, witnesses or court employees was in the copied files.

The Foster Care Review Board is a set of citizen panels inside the Supreme Court's Administrative Office of the Courts. They review children's cases and make recommendations to juvenile court judges.

According to the court, the copied reports can include information about children, names of the people involved, statements, the board's findings and its recommendations for courts, parents and the Arizona Department of Child Safety. They don't include addresses or phone numbers.

Arizona has about 8,000 children in foster care right now, KJZZ reports, citing the court. The court says the reports hold case information that was already shared with participants, including parents, through the board's normal process.

A foster care report or a protective order file is not like a leaked password: you can't reset it. That's why people connected to these records have reacted so strongly.

It started with phishing: a fake email designed to look real, so the person reading it clicks a link or types in a password.

Spokesperson Alberto Rodriguez told the Arizona Republic that this was not a targeted attack. A court employee opened a phishing email, and the attackers used that foothold to copy files. In Rodriguez's words to KJZZ, they "accessed our system via a phishing attack email and copied information from our backup servers."

Think of it like a building where someone props open the side door for a moment. The front desk can be excellent, but the storage room in the basement is still down the hall.

The catch: the files they grabbed were backups, kept for recovery after ransomware and other destructive attacks, according to Malwarebytes' summary of the court's update. Backups are supposed to be the safety net. Here, they were the target.

That's still unclear. The court says the backups were stored in a highly compressed format, and the Arizona Republic reports the data was encrypted.

"The court has no evidence that any data has been accessed, is readable, or has been shared," the court said in a statement quoted by KJZZ. Rodriguez repeated on Tuesday that "we don't have any evidence it has been used or shared."

A court spokesperson told Recorded Future News that this was not a ransomware attack and that no ransom had been demanded. No hacking group has publicly taken credit.

What's next: the FBI is investigating, and Timmer said she spoke directly with the special agent in charge. She told ABC15 that the courts have also alerted the state police.

The court says it's contacting people it believes were affected. People in the FARE program are being notified by text message, FOX 10 reports, and KJZZ says the court will also include breach information in mailed collections notices.

For foster care cases, the court says it notified the Department of Child Safety, attorneys for parents and children, juvenile court presiding judges and review board members.

Not everyone says they've heard anything. FOX 10 spoke with Lori Ford, an advocate with the Arizona Department of Child Safety Oversight Group, who said parents whose children's information may be involved have not been notified. A Mesa foster parent told AZFamily that court officials did not contact her either.

People with protective orders are feeling it too. One woman told ABC15 her records included her children's names and family addresses. She's now using a P.O. box, added security cameras and bought identity theft protection.

In real life If you get a text or email saying you're part of this breach, don't click any links in it. Go to azcourts.gov yourself, or call the court using a number you looked up on your own, to confirm it's real.

Courts hold exactly the kind of data attackers want. Recorded Future News notes that a ransomware attack shut down nearly all of Kansas' court systems in 2023 and took months to fully resolve.

State and local courts in California, Nebraska, South Carolina, Florida, Wisconsin, Louisiana, Ohio, Missouri and Illinois have faced ransomware, denial-of-service attacks or data breaches over the last four years, according to the same report.

We covered another huge government data leak just this week, when Denmark's national ID register was breached. Different country, different method, same lesson: the biggest risk often comes through a door that was supposed to be legitimate.

• If you've ever owed Arizona court fines or fees: you may be in the FARE data. Consider a credit freeze with Equifax, Experian and TransUnion, as the court recommends.
• If you have a protective order in Arizona: the court says your order is still valid and you don't need to refile. The AZPoint website was not compromised and is safe to use.
• Watch for fake follow-ups: scammers love a fresh breach. Anyone contacting you "about the Arizona court breach" should be verified through a channel you found yourself.
• Anywhere else: this all began with one phishing click. If an email link at work feels even slightly off, check with your IT team before you open it.