Arizona court cyberattack copied 1.3 million debt records and sensitive case files

A phishing message led to data being copied from backup servers

Arizona court officials say a September 24 cyberattack began after an employee clicked a malicious link in an email. Associated Press, KJZZ and Bloomberg Law independently reported that attackers copied files from court backup servers before technology staff stopped the intrusion about two hours after detecting it. The Arizona Supreme Court's September 25 notice confirmed that personally identifiable information had likely been copied but withheld details that could affect the investigation or people involved. [2][3][5][1]

The court says no records were altered or deleted and court proceedings were not delayed. AP reported that juror, witness and court-employee information was not taken. Court spokesperson Alberto Rodriguez said officials had no evidence as of October 6 that the copied data had been used or shared. That absence of evidence is not the same as proof that the files cannot be read or misused later. [2][3]

The largest dataset concerns court-ordered debts

The court said the copied Fines/Fees and Restitution Enforcement program data concerned roughly 1.3 million people with unpaid court-ordered victim restitution, fees or fines from civil, traffic and criminal matters stretching back about 30 years. KJZZ reported that the files included names and Social Security numbers. The total counts people in that program, not 1.3 million current court cases or confirmed identity-theft victims. [3][2][5]

The court began contacting affected people by text and said information would also appear in mailed collection notices, according to KJZZ. It directed affected people toward credit freezes or holds and identity-theft resources maintained by the Federal Trade Commission and the Arizona Attorney General. The court and FBI have not publicly identified the attackers or a motive. [3][1]

Protection-order and foster-care records create separate risks

AP reported that the copied material also included records connected to nearly 30,000 active and inactive orders of protection. Arizona courts describe an order of protection as a court order intended to stop domestic violence or contact with protected people. The reviewed sources did not provide a complete field list for the copied protection-order records, so this report does not assume that every file exposed a current address or safety plan. [2][6]

More than 150,000 Foster Care Review Board reports dating to 2010 were also copied. KJZZ reported that the confidential reports can contain child information, names of interested parties, review findings and recommendations, but not phone numbers or addresses. The court notified the Department of Child Safety, attorneys for parents and children, judges and board members. The AZPoint site used to request protective orders was not compromised and remained safe to use, Rodriguez told KJZZ. [4][2][5]

Compression does not resolve whether the files are readable

Rodriguez told KJZZ that officials did not know whether the attackers could read the files because the backup data had been stored in a highly compressed format. The reviewed statements did not say the files were encrypted or establish that compression blocked access. The careful conclusion is therefore limited: files were copied, the court had not seen evidence of use or sharing, and readability remained under investigation. [4][3]

The next accountability questions are whether the court discloses the full categories of copied data, the number of distinct people across overlapping datasets, the security controls on backup servers, the scope and timing of individual notices, and the FBI investigation's findings. No reviewed source identified the intruder or established criminal responsibility at publication. [1][2][5]

How the sources compare