Oct. 7, 2026. A cyberattack on Arizona’s court system copied personal information tied to about 1.3 million people with unpaid court fees, fines or restitution balances, according to new details released by the Arizona Supreme Court and reported by The Associated Press.
The compromised records span traffic and criminal matters going back as far as 30 years. Attackers also obtained nearly 30,000 active and inactive protection orders and about 150,000 foster-care review reports dating to 2010, court spokesperson Alberto Rodriguez told the AP.
Arizona court officials say they have found no evidence that the copied information has been used or shared. They also said no court records were changed or deleted and that court cases have not been delayed. The investigation remains active, so those findings could change.
What happened on Sept. 24
Court officials said the incident began after an employee clicked a malicious link in an email. Technology staff discovered activity on a backup server and shut it down about two hours later on Sept. 24.
Chief Justice Ann Scott Timmer publicly announced the attack the following day. In the court’s Sept. 25 urgent notice, she said the system had been targeted by criminal hackers or their bots and that personally identifiable information was believed to have been copied. She also said she had spoken with the FBI’s top-ranking official in Arizona.
The court initially withheld detailed counts while notifying people and protecting the investigation. The scope reported this week makes the incident substantially larger and more sensitive than the first notice established.
Which records were affected
According to the AP’s Oct. 6 report on the court’s disclosure, the stolen information falls into three large groups:
- Records for roughly 1.3 million people with unpaid court fees, fines or restitution associated with traffic and criminal violations.
- Nearly 30,000 active and inactive orders of protection.
- About 150,000 reports from a foster-care review board that advises courts in cases involving allegations that parents cannot safely care for a child.
Court officials said information about jurors, witnesses and court employees was not taken. They have not publicly identified the attackers or described every field contained in the copied records.
What affected people should do
The court says it is notifying people it believes were affected. Anyone who receives a notice should verify it through the official Arizona Courts cybersecurity alert hub rather than using contact information supplied in an unexpected email or text.
Because breach-themed phishing often follows public incidents, recipients should be cautious about links, attachments and requests for payment or account credentials. Court users can also consider reviewing their credit reports and placing a security freeze if the official notice indicates information useful for identity fraud was exposed.
The Arizona Attorney General’s data-breach page provides state-specific guidance on identity theft, credit freezes and breach notifications. The Federal Trade Commission’s IdentityTheft.gov offers recovery plans for people who discover misuse.
Questions still unanswered
The court has not disclosed the attacker’s identity, the exact data fields copied from each record set or whether the incident involved ransomware or an extortion demand. It has also not said whether all notifications are complete.
Those details will determine the practical risk to individuals. The absence of detected misuse is reassuring but does not prove the data will never be exploited. AskNovus will update this report if investigators identify the actor, clarify the data fields or change the number of affected people.
Follow AskNovus U.S. News and Technology for verified security updates.
Featured image credit: Nils Huenerfuerst/Unsplash. The image shows the Arizona State Capitol and is illustrative; it does not depict the affected court system or attack.