Arizona court data breach exposes 1.3 million via phishing

What happened

A single click on a malicious email link has become one of the most consequential public-sector data breaches of the year. The Arizona Supreme Court says hackers obtained personally identifiable or sensitive information on more than 1.3 million people after a court employee fell for what officials described as "a common phishing attack." 12

According to an updated FAQ from court officials, federal and state investigators confirmed that criminal hackers "accessed and copied backup court files." 2 The FBI is investigating. 3 The stolen backups reportedly contained Social Security numbers, protective-order information, and detailed reports on children and families in dependency proceedings. 3

The scale breaks down into several distinct pools of data:

• Court financial records: The largest share of the 1.3 million people appears tied to what officials call the FARE breach, a set of files connected to the court system's fines-and-fees collection operations. 2
• Foster care reports: More than 150,000 Foster Care Review Board reports for current and past cases dating back to 2010 were copied. These include about 8,000 children currently in foster care. 234
• Protective orders: Hackers also copied records involving active and inactive protective orders. 2 One outlet put that figure at nearly 30,000 records. 3

What the court says was not affected

The court has tried to limit the scope where it can. Officials say the attackers did not access information on jurors, witnesses, or court employees. They also say no court records were deleted, altered, or erased. 1 The court has also suggested that the format of the stolen files may make them hard for the hackers to read. 2

That last claim deserves caution. "Difficult to read" is not the same as encrypted. Backup formats that are obscure to a casual attacker are rarely a lasting barrier to a motivated one. Until investigators say more, affected people should assume the data is usable.

The court has set up an online portal where Arizonans can check whether their information was involved. Official notices will come by email from no-reply@courts.az.gov or by text from the short code 83958. 1 Scammers often follow large breaches with fake notifications, so people should know these legitimate channels. Breach notices have also gone to the Department of Child Safety, attorneys for parents, judges, and members of the Foster Care Review Board. 2

Why this breach is different

The 1.3 million figure drives the headlines, but the most troubling exposure is likely the smaller pools of data. Foster Care Review Board reports contain information on children, statements from families, investigative findings, and administrative notes. 2 Protective-order files can reveal where people seeking safety live or work. For many of these victims, the risk is not just identity theft. Leaked details could be used for harassment, coercion, or physical harm, and those harms cannot be fixed with a credit freeze.

The outlets broadly agree on the facts but differ in emphasis. The Record and Check Point's weekly threat roundup focus on the foster-care and protective-order data. 24 AZ Free News highlights the phishing origin and the court's reassurances about what was not touched. 1 The USA Herald takes the sharpest tone, calling the incident "far more serious than a routine computer intrusion." It asks how one employee's click could reach records this sensitive and what will prevent a repeat. 3

That question deserves an answer. Phishing will always succeed sometimes, so security design assumes some employee will eventually click. What matters is what that compromised account can reach. If one phishing-initiated intrusion could copy backup files covering financial records, child-welfare reports, and protective orders together, that suggests weak segmentation, broad access rights, or poorly protected backups. Those are architectural problems, not just training failures.

The broader context

Arizona's breach arrived in a busy week. Check Point's threat bulletin for the week of October 5 placed it alongside other incidents:

• A breach at Japanese car-sharing service Times Car affecting about 6.6 million accounts.
• A compromise of Polish invoicing platform Fakturownia that exposed password hashes, bank details, and authentication tokens. 4

The Arizona case stands out because of who holds the data. People do not choose to give information to a court the way they choose a car-sharing app. Defendants, parents in dependency cases, and protective-order petitioners hand over sensitive details because the legal system requires it. That makes the state's duty of care greater, not smaller.

The takeaway

The court's quick disclosure, lookup portal, and clear notification channels are reasonable steps. Its claim that the stolen file format offers some protection is less convincing. The real test will be whether Arizona explains how a phishing email led to backups this sensitive, and whether it limits that access before the next click. For the families named in foster-care and protective-order records, a full and public accounting matters more than any reassurance about file formats.