Breach · · 4 min read
Arizona’s courts say hackers copied a backup of 1.3 million people
The courts say a phishing email started it. The copied backup holds collections files, foster-care reports and protective orders.
On September 24, 2026, someone copied backup files from the Arizona court system. The Arizona Judicial Branch says the attack started around 11:30 a.m. and that its IT staff shut it down in less than two hours. The next day, Chief Justice Ann Scott Timmer told the public. The court’s own account is on azcourts.gov/cybersecurityalert. If you don’t live in Arizona and you’ve never had a case there, you aren’t in this backup. The part worth keeping is how small the opening was, and what was sitting in the copy.
What the court says was copied
The files came off a backup server, where the court keeps highly compressed copies. Staff say no court record was deleted, altered or erased, so pending cases, orders and court dates still stand. They also say they have no evidence the copied information has been shared, and that it isn’t clear whether most of the compressed data can be read easily. Those are the court’s words. “Copied” and “not yet seen in the wild” are different claims, and the court is making both.
Three sets of files were in the backup:
- FARE, the court’s collections program. About 1.3 million people with court debts going back 30 years. The data includes case numbers, names and Social Security numbers. FARE collects unpaid fines, fees and restitution from civil traffic, criminal traffic and criminal cases.
- Foster Care Review Board reports. More than 150,000 reports on current and past cases, dating to 2010. Arizona has about 8,000 children in foster care now. The court says these reports do not include addresses or phone numbers. They do include the child’s information, the names of interested parties, and the board’s findings and recommendations. The court notified the Department of Child Safety, the attorneys on those cases, juvenile presiding judges and the review board itself.
- Protective orders, active and inactive, including some sensitive information. The court has not published a count.
Based on what staff know so far, the copy did not include jurors, witnesses or court employees.
How they say it started
The court’s FAQ says the evidence so far points to an ordinary phishing email: an employee received it and clicked a malicious link. Annual training, twice-yearly scans and a 24-hour monitoring service were already in place. The court quotes NIST on the asymmetry: the attacker has to be right once.
Chief Justice Timmer said she spoke with FBI Special Agent in Charge Rebecca Day and that state and federal law enforcement were contacted. The September 25 news release is posted as a PDF.
If you might be in the file
Official email about this comes from no-reply@courts.az.gov. Official texts come from the short code 83958. The court also says it is using the mail and the news, so not hearing anything doesn’t mean you were left out, and a message that isn’t from those two channels isn’t the court.
- Open the checker from the court’s site, not from a link in a message. The lookup asks for a last name, a birth year and the last five digits of a Social Security number, and it only covers people referred to FARE. Type azcourts.gov/cybersecurityalert yourself and use the checker linked there. A text that says “confirm your information” is the shape of the next scam, whether or not your data was copied.
- If you are in the FARE set, the court is telling people to freeze credit. It names Equifax, Experian and TransUnion, and points to identitytheft.gov and the Arizona Attorney General’s breach page. A freeze stops new credit from being opened in your name. It doesn’t unwind a debt you already owe the court.
- Questions go to the court’s help desk, 602-452-3519 or 800-720-7743, weekdays from 7 a.m. to 6 p.m. That’s the number on the alert page, not a number from a text.
People in a dependency case or with a protective order in Arizona should treat unexpected calls about “your court file” the same way: hang up and use a number from azcourts.gov.
Sources
- Cybersecurity Alert, Arizona Judicial Branch.
- News release, September 25, 2026, Arizona Supreme Court Administrative Office of the Courts.
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.