Hackers copied personal information on about 1.3 million people from Arizona's court system after a court employee clicked a malicious link in an email, according to an Associated Press report published by SecurityWeek Tuesday. The stolen files also include nearly 30,000 protection orders and about 150,000 foster care review board reports.

What Happened

The intrusion was detected Sept. 24, and court technology staff shut it down on a backup server about two hours after discovering it, the AP reported. It began when an employee opened a link in a phishing email.

The largest set of records covers about 1.3 million people with unpaid court fees, fines and restitution tied to traffic and criminal violations, with records going back roughly 30 years. The attackers also took nearly 30,000 active and inactive protection orders and about 150,000 foster care review board reports dating to 2010.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

According to the court, the data was copied but not altered or deleted. Information on jurors, witnesses and court employees was not compromised, and no court cases were affected or delayed. The court said it has notified the people whose information was taken.

Alberto Rodriguez, a spokesperson for the Arizona Supreme Court, told the AP that the court has no evidence the data has been used or shared. The attackers have not been identified, and no ransomware group has publicly claimed the attack.

Why It Matters

The type of data taken is more sensitive than a typical customer database. Protection orders identify people who sought a court's help against an abuser and often include details that could help someone locate them. If those records were leaked, victims of domestic violence could face real physical risk, not only fraud.

Foster care review board reports concern children in state care and the families around them. Records of unpaid fines and restitution, meanwhile, link names to criminal and traffic cases, which scammers could use to send convincing fake payment demands posing as the court.

The way the attack started is also familiar. A single click on a malicious email link gave attackers enough access to reach a backup server holding decades of records. Backup systems often hold large volumes of older data in one place, which makes them an attractive target once an attacker is inside a network.

Context

State and local courts run large case management systems that hold years of filings, fines and orders. They have been targeted before; ransomware and other attacks have disrupted court operations in several U.S. jurisdictions in recent years. In this case the court said operations were not interrupted, and its account describes data theft rather than encryption of systems.

Because no group has claimed responsibility, it is not known whether the attackers intend to sell the data, demand payment or publish it. Data stolen in quiet intrusions sometimes appears on criminal forums or leak sites weeks or months later.

What to Watch

The investigation is ongoing, and the court has not said who carried out the attack. Key questions are whether any of the stolen records surface online, especially the protection orders, and whether the court offers credit monitoring or other help to those affected. The court has not yet described what security changes it is making after the attack, such as how it handles email links or limits access to backup systems.