Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data

The Thomson Reuters C-Track breach highlights the critical risk of storing highly sensitive government and personal data — including Social Security numbers, medical records, and sealed court documents — within third-party SaaS platforms without adequate access controls or monitoring. Unauthorized access persisted for approximately three months (March to June 2026), suggesting a significant failure in anomaly detection and real-time alerting that should have identified suspicious activity far sooner. Court case management systems are high-value targets precisely because they aggregate legally protected, sensitive data on a massive scale across multiple jurisdictions. The extended dwell time of the attackers amplifies the potential damage, as prolonged access allows for thorough data exfiltration that may not be fully scoped for weeks or months. This incident underscores that organizations processing government and legal data must hold their third-party vendors to the same — or higher — security standards they apply internally.