One Phishing Click, 1.3 Million People Exposed: Six Things to Know About the Arizona Courts Breach
Arizona court officials say hackers copied backup files holding data on more than 1.3 million people, plus sensitive foster care reports, after an employee clicked a phishing link.
Arizona’s court system has updated the public on a cyberattack first disclosed in late September, and the numbers are now much clearer. Here is what the latest update says, point by point.
1. It began with a single email
According to a new FAQ from court officials, investigators believe the attack started when a court employee clicked a malicious link in a phishing email. The intrusion began on September 24 and lasted until the court’s IT team shut the affected system down completely. The Arizona Supreme Court announced the breach on September 25.
2. Backup files were copied
Federal and state investigators confirmed that criminal hackers accessed and copied backup court files. The court says the format of those files may make them hard for the attackers to read, but the data was still taken.
3. A debt collection program held most of the records
The largest exposure involves the Fines/Fees and Restitution Enforcement (FARE) Program, a statewide program that helps courts collect outstanding debts from traffic and criminal cases. Its data goes back 30 years and includes names, Social Security numbers and case numbers for 1.3 million people. Affected people will be contacted by text message, and officials are urging them to place holds on their credit.
4. Foster care files were also taken
The attackers reached reports created by the Foster Care Review Board, which makes recommendations to juvenile court judges. More than 150,000 reports from current and past cases dating back to 2010 were involved, including cases for 8,000 children now in foster care. The reports contain details about children, family statements, investigative findings and administrative notes. Records about active and inactive protective orders were copied as well.
5. Notifications are going out
The court system has notified the Department of Child Safety, attorneys who represent parents, judges and Foster Care Review Board members. Chief Justice Ann Scott Timmer said she spoke personally with FBI Special Agent in Charge Rebecca Day and is working with state officials on the recovery.
6. No ransom demand, and no claim of responsibility
As of Wednesday, no hacking group had taken credit. A court spokesperson had earlier said the incident did not involve ransomware and that no ransom demand had been made as of Monday.
Jonathan Greig covered the updated FAQ for The Record.
What this means for your company
- Phishing is still the front door. One click led to a breach of this size. Ongoing awareness training, plus technical controls such as link scanning and phishing-resistant multifactor authentication, cut that risk sharply.
- Protect your backups like production data. Here, backup files were what got copied. Encrypt backups, restrict who can reach them, and monitor access to backup storage.
- Keep only what you need. Records going back 30 years multiplied the impact. A data retention policy that deletes old records on schedule shrinks what an attacker can steal.
- Have a shutdown plan. Know in advance who can take a compromised system offline and how fast you can do it.
Need help reducing phishing risk and securing your backups? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
