Arizona Judicial System Breach Compromises Records for 1.3 Million Court Debtors

Arizona's court system experienced a two-hour cyber attack on September 24 that compromised personal information spanning three decades for approximately 1.3 million individuals involved in debt collection cases, along with over 150,000 confidential foster care documents. The breach occurred when a court employee opened a phishing email that allowed attackers to access a backup server containing encrypted data including names, case numbers, and Social Security numbers. Officials stated the encrypted data has not been deciphered and no evidence suggests any information was accessed or shared, with no court records being deleted or altered.

The breach affected two distinct populations through a single security incident. The primary impact touched individuals with outstanding court-ordered financial obligations—fines, fees, and restitution amounts—spanning three decades of collections cases. A secondary and more sensitive disclosure involved confidential documents from the state's foster care review system, affecting children, parents, and case participants since 2010.

The attack's technical mechanism was relatively simple: a court staff member unknowingly activated malicious code embedded in an email, granting attackers temporary access to encrypted backup files. While officials confirmed the data remains encrypted with no evidence of successful decryption or distribution, the incident nonetheless exposed the vulnerability of sensitive government databases to social engineering tactics targeting employees.