Arizona Court Breach Exposes 1.3 Million Social Security Numbers

A single click, a statewide breach

Arizona's judicial branch has confirmed that a phishing attack exposed sensitive personal data on roughly 1.3 million people. The exposed records include Social Security numbers tied to decades of court debt, along with highly sensitive files on children in foster care. In an updated notice, court officials said federal and state investigators had verified that criminal hackers "accessed and copied backup court files."14

The Arizona Supreme Court's account says the intrusion began around 11:30 a.m. on Thursday, September 24, 2026. A court employee clicked a malicious link in an email.23 Court IT staff shut down the activity on a backup server less than two hours after it was identified.24 One account frames that window as roughly two hours during which the attackers went undetected.3 That difference matters. Containing an intrusion within two hours of detection is not the same as attackers being active for only two hours. The public statements so far do not settle how long the intruders were inside before anyone noticed.

What was taken

The largest haul came from FARE, the courts' Fines/Fees and Restitution Enforcement program, which collects court debt. That data set held names, case numbers and Social Security numbers for about 1.3 million people whose court debts stretch back 30 years.24 The records cover unpaid fees, fines and restitution for traffic and criminal violations.3

The attackers also copied more than 150,000 reports from the Foster Care Review Board, the body that reviews child welfare cases and makes recommendations to juvenile court judges.15 Those reports date to 2010 and cover about 8,000 children currently in foster care. They contain information about the children, statements from families, investigative findings and administrative notes.1 One summary attached the 30-year figure to the foster care reports. Other accounts tie the three-decade span to the debt records and the 2010 start date to the foster care files.324

Protective-order records were also copied. One report puts the figure at nearly 30,000 active and inactive orders.35 The courts have notified the Department of Child Safety, attorneys representing parents, judges and Foster Care Review Board members.1

Readable or not?

Officials have sent mixed signals about how usable the stolen data is. The court has said the backups were stored in a highly compressed format that may be hard for the attackers to read. It has also said there is no evidence the data has been shared.14 But Chief Justice Ann Timmer said the court is operating on the assumption that the attackers "will be able to read the names and match it to a Social Security number."2

The chief justice's position is the more defensible one. Compression is not encryption. Criminal groups that go to the trouble of copying backup archives generally expect to extract value from them. Affected Arizonans should plan around the worst case rather than rely on the format of the files.

Why this breach stands out

By raw numbers, 1.3 million records is significant but not extraordinary. In the same week, a Japanese car-sharing service disclosed a breach affecting about 6.6 million accounts.5 What sets the Arizona incident apart is the kind of data involved.

Social Security numbers paired with names are a durable tool for identity fraud, and they cannot be reissued like passwords. The foster care and protective-order files are arguably more dangerous. Protective orders exist because someone faces a credible threat. Exposing details about those individuals, or about children in state custody, creates risks of physical harm, harassment and coercion that credit monitoring cannot address.

The notification process itself carries a risk. The court is warning victims by email and text, which are the same channels scammers are likely to use to impersonate officials.2 Recipients should verify any breach-related message through official court websites rather than links or phone numbers in the message.

Who pays

The incident is also shaping up as a financial test. Arizona self-insures cyber losses through a state program rather than buying commercial coverage. As a result, notification, investigation and remediation costs fall on that fund.4 How it absorbs a breach of this size, especially one involving vulnerable populations and possible litigation, could shape how other states weigh self-insurance against the private cyber market.

The takeaway

The pattern is familiar: one phishing email, one click, and access to backup systems holding years of accumulated sensitive records. The containment appears to have been fast once the intrusion was spotted. The deeper issue is that decades of debt records and children's case files were sitting together in backups reachable from a compromised account. For public institutions, backups are often treated as a safety net. This breach shows they can also be the most attractive target on the network.