Arizona Court Cyberattack: Data of 1.3 Million People Copied After Phishing Email
The Arizona Supreme Court has said that a cyberattack on the state's court system copied the personal information of about 1.3 million people, in a breach that officials believe began when a court employee clicked a malicious link in an email.
According to the court, the copied records relate to people with unpaid court fees, fines and restitution payments for traffic and criminal offences, and date back as far as 30 years.
The attackers also took records of nearly 30,000 active and inactive orders of protection, along with about 150,000 reports dating back to 2010 from a foster care board that makes recommendations in cases where parents are alleged to be unfit or unable to care for a child.
The court's technology staff spotted the attack on a backup server on September 24 and shut it down about two hours later. The court has since notified the people whose information was affected.
"We don't have any evidence it has been used or shared," state Supreme Court spokesperson Alberto Rodriguez said on Tuesday.
Mr Rodriguez said the attack, which is under investigation, has not affected or delayed any court case. No records were altered or deleted, and the attackers did not take information about jurors, witnesses or court employees.
The court has not released further details about the categories of personal information contained in the copied records, beyond the type of case or payment they relate to. Under laws in most US states, public agencies are generally required to inform individuals when their personal data has been exposed, though the exact requirements vary from state to state.
The nature of some of the material involved has, however, drawn attention. Orders of protection typically carry names, addresses and details of the allegations made by a person seeking protection from violence or harassment. Foster care board reports can concern sensitive family circumstances and, in some cases, information about children.
Such details can be misused. Fraudsters frequently draw on data exposed in breaches to make phishing messages — emails, calls or texts that impersonate an official body — more convincing. People whose information was copied are therefore generally advised to be cautious about unexpected messages referring to court payments or legal notices, and to check their financial and credit records for unfamiliar activity.
Court systems and other public institutions in the United States have reported a growing number of cyber intrusions in recent years. Public bodies hold large volumes of personal data, and security researchers have long noted that their systems can be less well protected than those of large private companies.
Arizona's courts serve a state of more than seven million people and handle a wide range of traffic, criminal, civil and family matters. The breach has not disrupted that work, the court said.
Officials have not said who was behind the attack, and the investigation is continuing. The court said it had completed notifying those affected and that its systems were functioning normally.
