A phishing email let a malicious bot access Arizona’s statewide judicial network and download a large volume of data before IT staff detected it and shut down the connection. Court officials believe the copied data includes names and home addresses tied to current and expired protective orders for potentially tens of thousands of individuals. No evidence yet shows the data has been shared. The FBI has been notified. The court has set up a call center and FAQ page at azcourts.gov/cybersecurityalert.
These aren’t ordinary breach victims. People with protective orders are, by definition, individuals a court has already determined to be at risk from another specific person. Exposing their home addresses to unknown parties is a different category of harm from a leaked email or a stolen password.
Arizona Supreme Court Chief Justice Ann Timmer went public with the breach over the weekend.
What Happened and How Fast It Was Caught
The breach began with exactly one email to one employee. That’s how most phishing attacks work. They don’t need to find a gap in your firewall or exploit a software vulnerability. They need one person having a distracted moment.
“It only takes one time for an employee to click on the email they shouldn’t click on,” Chief Justice Timmer said. “And in comes some kind of bot or automated system or something that can worm its way into your system, and that’s what happened.”
Once that automated system was inside, it began extracting data. Arizona court IT staff caught it by monitoring outbound traffic and noticing a volume that didn’t match normal patterns. The system was shut down immediately after they detected the anomaly.
“An inordinate amount of data was going out, being downloaded from our system, so it was shut down immediately,” Timmer said.
The key unknowns: investigators don’t yet know exactly how much was taken, and Timmer specifically noted the court doesn’t yet know whether the downloaded data is “easily readable.” That last detail matters. If the data was encrypted at rest and the keys weren’t accessible to the bot, the stolen files may be difficult or impossible to read. The FBI is currently investigating alongside court officials.
Why Protective Order Data Is Specifically Dangerous
A protective order is different from most other records held by court systems. It exists precisely because someone has gone through a legal process to demonstrate they need protection from a specific individual, most often in domestic violence, stalking, or harassment situations.
These records contain the protected person’s name and current home address. They also indicate whether an order is currently active or expired. For someone whose abuser or stalker has connections to criminal networks or can purchase data from underground markets, this information creates a direct physical security risk. This isn’t identity theft in the abstract. It’s a map to where someone who went to court specifically because they feared for their safety now lives.
Jennifer Coffindaffer, a retired FBI special agent, described the specific value of court system data to financial criminals as well. “The money is the motive almost always,” she told FOX 10. “Specifically, people want to sell that information, and it can be worth a lot. You’re talking about people in the court system. You’re talking about people with protective orders.”
The vacant homes mail fraud case we covered earlier this month showed precisely why home address data has become a high-value commodity on criminal markets, not just for fraud, but for physical targeting. Court-verified addresses of people in legally documented danger represent a specific and serious subset of that risk.
The Systemic Vulnerability One Email Reveals
No system that handles data of this sensitivity should be accessible to full exfiltration through one compromised employee account. Timmer acknowledged the court had extensive cybersecurity safeguards, 24/7 monitoring, regular security scans, and required employee training, but also acknowledged that none of them caught the phishing email before it was clicked.
This is the consistent gap that the supply chain attack early-warning research we’ve covered this year keeps pointing to: the most effective initial access method isn’t a technical exploit. It’s a convincing email. Once an attacker has an authenticated user’s session, their permissions become the attacker’s permissions.
The specific risk with judicial systems is access scope. A judge’s assistant, a case manager, or an IT administrator can legitimately access records across many case types. A bot that inherits their session inherits that access range too. This means one phishing email can open a door to data belonging to potentially tens of thousands of people who have never interacted with that employee.
Greenberg Traurig, Law Firms, and Legal Data as a Recurring Target
The Arizona court breach follows a well-documented pattern of attackers specifically targeting legal systems for the sensitive personal data they hold. Earlier this month, we covered SilentRansomGroup’s coordinated campaign against six law firms in a three-week window, specifically because legal data holds a unique combination: personal identity details, financial disclosures, litigation strategy, and, for cases involving domestic matters, the precise personal circumstances and locations of individuals in vulnerable situations.
Courts are even richer targets than law firms in one specific respect: they hold records across every attorney and every party in every case, not just the clients of one firm. A breach of a statewide judicial network potentially touches every case filed in that system.
What’s Being Done for Affected People
Chief Justice Timmer laid out the official response. The court has notified the FBI. Local law enforcement agencies have been alerted. A dedicated call center has been established for people with questions. A public FAQ page is available at azcourts.gov/cybersecurityalert covering what happened, what’s known, and what people with protective orders should do.
Court records and case schedules were not affected. The breach appears confined to the personal data that was actively copied, not to the court management systems themselves.
Timmer also told anyone who feels they are in immediate danger to contact local police. That guidance isn’t purely precautionary; for people with active protective orders in cases involving violent or coercive individuals, the possibility that their home address is now in unknown hands is a legitimate safety concern that warrants speaking to law enforcement.
What Affected Individuals Should Do Right Now
If you hold a current or expired Arizona protective order, treat this as a real exposure until the investigation determines the data is unreadable or otherwise safe.
Alert local law enforcement. Tell them you may have been affected by the Arizona court breach and that you have an active protective order. Ask whether they can note any additional concerns in your area.
Contact the court’s call center. The Arizona Supreme Court has established direct communication channels. Get on record as potentially affected so you receive updates as the investigation progresses.
Document any suspicious contact. If you receive unexpected messages, calls, or visits from unknown parties in the coming weeks, report them to police and note the date and details. Early documentation supports protective action.
Consider updating your protective order if your circumstances have changed. If you’ve moved or have new safety concerns, this is a good moment to confirm your current order reflects your current situation.
Resources for anyone in danger: The National Domestic Violence Hotline operates 24/7 at 1-800-799-7233 (SAFE) for people who need immediate safety planning guidance.
For a general guide on what to do when personal data has been exposed, our dark web data exposure guide walks through the full checklist.
Frequently Asked Questions
What happened to Arizona’s court system?
A phishing email allowed a bot to access the Arizona judicial network and download a large volume of data before IT staff detected and terminated the connection. The breach was discovered Thursday, September 25, 2026.
What information was exposed?
Court officials believe hackers may have copied names and home addresses associated with current and expired protective orders for tens of thousands of individuals.
Was the copied data encrypted?
Unknown. Timmer specifically said investigators don’t yet know if the downloaded data is “easily readable.” This is still under investigation.
Were court records or schedules affected?
No. The breach affected personal data in the judicial network, not the case records or scheduling systems themselves.
What should protective order holders do?
Contact law enforcement, use the court’s call center, document any suspicious contact, and visit azcourts.gov/cybersecurityalert for official updates.
