A single email started it. On the morning of Thursday, September 24, an Arizona court employee clicked a malicious link. By the time court IT staff shut the intrusion down, less than two hours after spotting it, the attackers had copied backup files covering three of the most sensitive groups the court system serves. The Arizona courts data breach, the court now says, includes names and Social Security numbers for “Approximately 1.3 million individuals who have court debts dating back 30 years,” along with protective-order records and foster care reports.
Where it stands: As of the Associated Press report on October 7, the court said it had no evidence the data had been used or shared. Notices are going out by text, email and mailed collection letters, and the court is urging people in the debt program to freeze their credit. The attackers have not been identified.
What happened in the Arizona courts data breach
The Arizona Supreme Court has set up a cybersecurity alert hub at azcourts.gov with FAQs for each affected group. It describes the start this way: “It appears to have started on Thursday, September 24 around 11:30 a.m. and court IT staff shut it down less than two hours after it was identified.”
The way in was ordinary. “Evidence so far suggests the cyberattack began with a common phishing attack, where a court employee received an email and clicked a malicious link,” the court says. A court spokesperson told The Arizona Republic, as carried by GovTech, that “This was not a targeted attack, but instead an instance of a court employee opening a phishing email.”
What the intruders took were backup copies, not live case files. The court says “no court records were deleted, altered, or erased,” so pending cases, court dates and existing orders are unaffected.
Three groups whose records were copied
The court’s disclosures came in stages. Protective-order holders were warned first, in late September; foster care reports were added a few days later; and the much larger debt-collection data set followed. Here is how they compare.
| Group | Size, per the court or AP | Data involved |
|---|---|---|
| FARE debt program | About 1.3 million people | Names, case numbers, SSNs |
| Protective orders | Nearly 30,000 orders (AP) | Records incl. some confidential addresses |
| Foster Care Review Board | More than 150,000 reports | Case details; no addresses or phones |
The FARE program. FARE, the Fines/Fees and Restitution Enforcement program, collects court-ordered debt from civil traffic, criminal traffic and criminal cases. The court says the data “includes sensitive information about individuals referred to the FARE Program, such as case numbers, names, and social security numbers.” Not everyone who ever paid a ticket is in it. A court spokesperson told The Arizona Republic: “This data set does not include information for individuals who have not been sent to collections for unpaid court-ordered fees, fines, or restitution.”
Protective orders. The court says the copied files included “records involving active and inactive protective orders, including some sensitive information.” The AP put the count at “nearly 30,000 active and inactive orders of protection.” For these people, the worry is physical safety rather than credit. AZFamily reported that some notices went to people “whose confidential address on file with the court may have been compromised.” One woman told the station: “The whole reason I had a protective order and had my information on file with the court was because I need that information protected.”
Foster care reports. “More than 150,000 reports for current and past cases were included, dating back to 2010,” the court says, adding that the state has “approximately 8,000 children currently in foster care.” The reports are written by citizen review panels and contain case findings and recommendations, but the court says “No contact information such as addresses and phone numbers are included in the report.”
Not included, according to the court: “none of the data copied included information on jurors, witnesses, or court employees.”
Can the stolen data be read?
This is the one piece of potentially good news, and it is uncertain. The court says “The data was copied from a back-up server where highly compressed information is maintained. The court has no evidence that any data has been accessed, is readable, or has been shared.” Spokesperson Alberto Rodriguez told the AP: “We don’t have any evidence it has been used or shared.”
No evidence is not the same as safe. Malwarebytes notes the court “has not identified the attackers or a motive,” and that “no ransomware group has publicly claimed responsibility.” The FBI is involved; the court says Chief Justice Ann Timmer “personally spoke with FBI Special Agent in Charge Rebecca Day and pledged the court’s full cooperation to investigate the attack.”
How the court is contacting people
Because scammers love a government breach, it helps to know exactly what a real notice looks like. For the FARE group, the court says notifications “will be sent to individuals in the court’s FARE program via text messages. An alert has also been added to collections notices that are sent via U.S. Postal Service.” Its official texts come “via text from 83958 (a short-code number),” and official emails come from the court’s own address.
If you want to check, the court’s help desk is listed on the hub: “call the Arizona Courts Help Desk at 602.452.3519 or 800.720.7743. It’s available Monday-Friday from 7 a.m. to 6 p.m.” Type the number yourself rather than calling one supplied in a message.
What to do after a government-records breach
Steps depend on which group you belong to.
- FARE debtors: freeze your credit. The court is urging affected people “to place a hold or freeze on their credit files with the three major credit reporting agencies: Equifax, Experian and TransUnion,” FOX 10 reports. A freeze is free and blocks new accounts in your name. Our guide to freezing credit at all three bureaus has the links.
- Use the official resources. The court points people to the FTC’s IdentityTheft.gov and the Arizona Attorney General’s data breach page at azag.gov.
- Expect debt-themed scams. Everyone in the FARE data was sent to collections over court debt, which makes fake threats of arrest over unpaid fines especially believable. Pay court debt only through the court’s own payment portal, reached by typing azcourts.gov yourself.
- Protective-order holders: review your safety plan. If your address may have been exposed, talk to your victim advocate or a domestic violence service about whether to update your safety plan, and tell your local police about the notice. Do not rely on a court record staying confidential.
- Foster families and parents: attorneys and caseworkers have been notified, according to the court. Ask your caseworker or attorney what was in your case’s reports.
For more on keeping legal records from being misused, see our guide to protecting your court records online. The court says its review of the attack will lead to changes, and its hub page is where it has promised the latest information as it comes in.
Frequently Asked Questions
Who was affected by the Arizona courts data breach?
The court has identified three groups: about 1.3 million people referred to its FARE program for unpaid court fines, fees or restitution; people with active or inactive protective orders; and the subjects of more than 150,000 Foster Care Review Board reports. The court says jurors, witnesses and court employees were not included.
Was my Social Security number exposed in the Arizona court hack?
If you were ever sent to collections through the FARE program for court debt, possibly. The court says that data set includes case numbers, names and Social Security numbers, going back 30 years. People who were never sent to collections are not in that data set, according to a court spokesperson.
How do I know if an Arizona court breach message is real?
The court says official notices come by email from the court or by text from the short code 83958, and that FARE notices are also added to mailed collection letters. If in doubt, go to azcourts.gov yourself or phone the help desk numbers listed on that page rather than using a link.
Has the stolen Arizona court data been leaked?
The court says it has no evidence the data has been shared or even that it is readable, because the copied backup files were highly compressed. No ransomware group has publicly claimed the attack. That could change, so it is still worth freezing your credit if you are in the FARE data.
Who hacked the Arizona court system?
The attackers have not been identified. The court says the intrusion began when an employee clicked a malicious link in a phishing email, and the FBI is involved in the investigation.
Sources
- Cybersecurity Alert (information hub and FAQs) — Arizona Supreme Court / Arizona Judicial Branch, undated hub page, retrieved October 22, 2026
- Personal information for over 1 million people stolen in cyberattack on Arizona court system — KOLD News 13 (Associated Press), October 7, 2026
- Arizona court system cyberattack potentially exposes over 1 million in debt program — FOX 10 Phoenix, not shown on cached page (early October 2026)
- Victim says Arizona court cyberattack has left her feeling ‘vulnerable’ — AZFamily (3TV/CBS 5), September 26, 2026
- Arizona Courts Cyber Attack Exposed 30 Years of Personal Data — Government Technology (TNS, from The Arizona Republic), October 2026 (cites a September 30 update)
- Hackers steal protective order and foster care records from Arizona courts — Malwarebytes, October 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.