Thomson Reuters has disclosed that an unauthorized party obtained files from C-Track, the court case management platform operated by its West Publishing Corporation unit. The intrusion occurred in March 2026 but was not discovered until June 30, 2026 — a dwell time of roughly three months. The blast radius is significant: courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada are affected, and a subset of the stolen records contains individuals' names and Social Security numbers, alongside potentially sealed court data.
This is not a commodity ransomware smash-and-grab. This is a breach of judicial infrastructure — systems that hold some of the most sensitive records in any jurisdiction: sealed filings, juvenile records, protective orders, witness information, and unredacted PII. For defenders, the three-month detection gap is the story within the story. An attacker lived inside a multi-tenant SaaS-adjacent case management platform for a quarter of a year before anyone noticed.
If you operate, host, or integrate with court case management systems — C-Track or otherwise — this post gives you the detection logic, hunting queries, and hardening steps to make sure you are not the next disclosure.
Technical Analysis
What We Know
- Affected product: C-Track Court Case Management System, operated by West Publishing Corporation (a Thomson Reuters unit)
- Attack window: Initial unauthorized access in March 2026; discovered June 30, 2026 (~90+ days of dwell time)
- Affected entities: Courts in 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada
- Data at risk: Names, Social Security numbers, and — critically — sealed court records, which by definition were never intended for any party outside the court
- CVE: None has been published as of this writing. No public attribution, no confirmed initial access vector, and no CISA KEV entry tied to this incident.
The Likely Attack Surface
Without a disclosed root cause, defenders should treat this as a composite scenario covering the most common access paths into case management platforms, based on how comparable LegalTech and government SaaS breaches typically unfold:
- Compromised credentials or session tokens for privileged accounts — vendor support accounts, court administrator accounts, or integration service accounts with broad cross-jurisdiction read access. Multi-tenant platforms amplify this: one credential can reach dozens of courts.
- Web application exploitation — unauthenticated or low-privilege vulnerabilities (IDOR, broken access control, injection) in the case management portal or its API endpoints, allowing bulk enumeration of case records.
- Bulk export abuse — the attacker used legitimate platform functionality (report generation, case export, document download APIs) at abnormal volume or cadence. This is the quietest exfiltration path and the one most consistent with a three-month dwell time.
The sealed-record exposure is the sharpest indicator. Sealed documents sit behind additional access controls in any properly designed CMS. Reaching them implies either privileged account compromise or an authorization failure in the application layer — not merely a perimeter misconfiguration.
Exploitation Status
- In-the-wild exploitation: Confirmed — the breach occurred; records were obtained.
- Public PoC: None. No CVE assigned.
- CISA KEV: Not listed as of this writing.
- Attribution: Unknown. No threat actor has claimed responsibility.
Detection & Response
The detections below are built for the behaviors this class of intrusion produces: anomalous bulk access to case records, database-level extraction from application servers, and suspicious authentication into court management platforms. They are tuned to be useful whether you run C-Track, a competing CMS, or any records-management platform holding regulated PII.
Sigma Rules
---
title: Database Dump Utility Execution on Web or Application Server
id: 4b8e2a91-6c3f-4d1a-9e57-2f7a0b1c8d44
status: experimental
description: Detects execution of database export utilities (mysqldump, pg_dump, sqlcmd, expdp) spawned by or alongside web server processes — a hallmark of attacker-driven bulk data extraction from case management or records platforms.
references:
- https://attack.mitre.org/techniques/T1530/
- https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.collection
- attack.t1530
- attack.t1005
logsource:
category: process_creation
product: windows
detection:
selection_tools:
Image|endswith:
- '\mysqldump.exe'
- '\pg_dump.exe'
- '\sqlcmd.exe'
- '\expdp.exe'
- '\bcp.exe'
selection_suspicious_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\java.exe'
- '\tomcat9.exe'
condition: selection_tools and selection_suspicious_parent
falsepositives:
- Scheduled database backups run under application service context — baseline backup windows and exclude known backup accounts
level: high
---
title: Anomalous Bulk Archive Creation in Web Application Data Directories
id: 9c1d5e72-3a84-4f62-b708-5e9d2c4a7f13
status: experimental
description: Detects compression/archiving of files within case management document stores or upload directories — consistent with staging sealed records or case files for exfiltration.
references:
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_archiver:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
- '\tar.exe'
- '\powershell.exe'
selection_target_dirs:
CommandLine|contains:
- '\casefiles\'
- '\documents\'
- '\uploads\'
- '\docket\'
- '\c-track\'
- '\cmsdata\'
- 'Compress-Archive'
condition: selection_archiver and selection_target_dirs
falsepositives:
- Legitimate document retention/archival jobs — correlate with scheduled task inventory and service accounts
level: high
---
title: Web Server Process Spawning Command Shell or Scripting Engine
id: 2e7f4b18-8d56-4a93-c164-7b3e9f5a0d28
status: experimental
description: Detects web server worker processes spawning command shells or scripting engines — a generic but high-fidelity indicator of web application exploitation leading to command execution on case management platforms.
references:
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\php-cgi.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare on production CMS servers; legacy applications that shell out for PDF rendering or document conversion — scope by known-good parent command lines
level: critical
KQL — Microsoft Sentinel / Defender Hunt
The following hunt identifies bulk data transfer patterns and anomalous authentication against case management infrastructure. Ingest your CMS web/app logs via Syslog or CEF for the CommonSecurityLog/Syslog portions; DeviceNetworkEvents covers Defender-onboarded servers.
// Hunt 1: Abnormal outbound data volume from CMS application/database servers
// Baseline deviation catches slow exfiltration consistent with multi-week dwell time
let ServerWatchlist = dynamic(["ctrack-app-01", "ctrack-db-01"]); // replace with your CMS hosts
let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where DeviceName has_any (ServerWatchlist)
| summarize AvgDailyBytes = avg(tolong(AdditionalFields)) by DeviceName; // refine to your bytes field
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any (ServerWatchlist)
| where ActionType == "ConnectionSuccess"
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize Connections = count(), UniqueDestinations = dcount(RemoteIP), Destinations = make_set(RemoteIP, 20) by DeviceName, bin(TimeGenerated, 1h)
| where UniqueDestinations > 25 or Connections > 5000
| project TimeGenerated, DeviceName, Connections, UniqueDestinations, Destinations
| order by TimeGenerated desc;
// Hunt 2: Authentication anomalies — logins to CMS admin/SSO from new geographies or unusual hours
SigninLogs
| where TimeGenerated > ago(14d)
| where AppDisplayName has_any ("C-Track", "Court", "Case Management") or AppId in (dynamic(["<your-cms-app-id>"]))
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize SigninCount = count(), Countries = make_set(Country), IPs = make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1d)
| where array_length(Countries) > 1 or SigninCount > 50
| order by SigninCount desc;
// Hunt 3: Bulk record access via proxy/WAF logs (CEF/Syslog ingestion)
// High request counts to case-record or document-download endpoints from a single source
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/api/", "/case/", "/document/", "/docket/", "/export", "/download")
| summarize Requests = count(), Endpoints = make_set(RequestURL, 30) by SourceIP, bin(TimeGenerated, 1h)
| where Requests > 500 // tune to your platform's normal user behavior
| order by Requests desc
Velociraptor VQL — Endpoint Forensics on CMS Servers
Deploy this hunt across application and database servers hosting case management workloads to identify staging archives, dump artifacts, and anomalous processes left behind by an extraction effort.
-- Hunt: Identify data staging archives and dump artifacts on CMS application/database servers
-- Looks for recently created archives in application data paths and running dump utilities
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(mysqldump|pg_dump|sqlcmd|bcp |expdp|Compress-Archive|7z|rar)'
OR Exe =~ '(mysqldump|pg_dump|7z|rar)'
// Companion artifact: recently created large archives in document/data stores
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['C:/inetpub/**/*.zip', 'C:/inetpub/**/*.7z', 'C:/inetpub/**/*.rar',
'D:/CMSData/**/*.zip', 'D:/CaseFiles/**/*.7z', 'D:/CaseFiles/**/*.zip'])
WHERE Mtime > timestamp(epoch=1748736000) -- artifacts created after June 1, 2025 (adjust to your investigation window)
AND Size > 10485760 -- >10MB, filters trivial app-generated archives
ORDER BY Mtime DESC
Remediation & Audit Script
Use this PowerShell on Windows-hosted CMS application servers to audit for evidence of bulk extraction and to lock down the most commonly abused surfaces. Run under an elevated account; review output before applying the hardening block.
# ===== PHASE 1: FORENSIC AUDIT — evidence of bulk extraction =====
# Recent archives staged anywhere under web roots or data volumes
$paths = @('C:\inetpub','D:\CMSData','D:\CaseFiles','E:\') | Where-Object { Test-Path $_ }
Get-ChildItem -Path $paths -Recurse -Include *.zip,*.7z,*.rar,*.bak,*.sql,*.dump -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-120) -and $_.Length -gt 10MB } |
Select-Object FullName, Length, LastWriteTime, CreationTime |
Export-Csv -Path .\CmsDataStaging_Audit.csv -NoTypeInformation
# Process execution history for dump/archiver tools (Sysmon Operational log, Event ID 1)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'mysqldump|pg_dump|sqlcmd|expdp|\bbcp\b|Compress-Archive|7z\.exe|rar\.exe' } |
Select-Object TimeCreated, Message |
Export-Csv -Path .\CmsDumpToolExec_Audit.csv -NoTypeInformation
# IIS logs: bulk hits to document/case endpoints from single sources
$iisLogRoot = 'C:\inetpub\logs\LogFiles'
if (Test-Path $iisLogRoot) {
Get-ChildItem $iisLogRoot -Recurse -Filter *.log |
Select-String -Pattern '(/document|/download|/export|/api/)' |
Group-Object { ($_.Line -split ' ')[8] } | # c-ip field position — verify against your log format
Where-Object { $_.Count -gt 500 } |
Sort-Object Count -Descending |
Export-Csv -Path .\CmsBulkAccess_Audit.csv -NoTypeInformation
}
# ===== PHASE 2: HARDENING — apply only after change control review =====
# Disable SMBv1 and restrict outbound SMB from app servers (exfil path reduction)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
New-NetFirewallRule -DisplayName "CMS-Deny-Outbound-SMB" -Direction Outbound -Protocol TCP -RemotePort 445 -Action Block
# Enforce TLS 1.2+ for IIS/app traffic
$tlsPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols'
foreach ($p in @('TLS 1.0','TLS 1.1','SSL 3.0')) {
New-Item -Path "$tlsPath\$p\Server" -Force | Out-Null
Set-ItemProperty -Path "$tlsPath\$p\Server" -Name Enabled -Value 0
}
Write-Host "Audit complete. Review CmsDataStaging_Audit.csv, CmsDumpToolExec_Audit.csv, CmsBulkAccess_Audit.csv before escalating."
Remediation
Given no CVE or vendor patch has been published for this incident, remediation divides into two tracks: obligations for affected parties, and defensive action for any organization running a case management platform.
For courts and organizations notified as affected:
- Treat sealed-record exposure as a distinct incident class. Sealed data carries court orders, statutory confidentiality obligations, and in some jurisdictions contempt implications. Involve the court's administrative office and legal counsel immediately — this is not purely an IT notification exercise.
- Demand forensic specifics from Thomson Reuters / West Publishing: initial access vector, exact record sets accessed per jurisdiction, per-user access logs for the March–June 2026 window, and confirmation of whether sealed-document access controls were bypassed or abused via legitimate privileges.
- Execute breach notification obligations. SSN exposure triggers state breach notification statutes across the affected jurisdictions, plus Canadian requirements under PIPEDA for the Ontario exposure. Do not wait for the vendor to drive your notification timeline.
- Rotate everything in the blast radius. All court administrative credentials, vendor support accounts, API keys, service accounts, and SSO federation certificates touching the platform — assume any of them could have been the entry point.
For any organization operating a case management or records platform:
- Close the dwell-time gap. Three months of undetected access means either logging wasn't reaching a monitored destination, or nobody was alerting on the access patterns that matter. Audit your CMS today: are application-layer access logs (record views, document downloads, exports) being shipped to your SIEM at all? Web server logs alone will not catch bulk record access through a functioning application.
- Alert on volume, not just anomalies. Define per-user and per-IP baselines for document retrieval and case-record API calls. A court clerk pulling 200 documents a day is normal; 50,000 is an incident. This single control would have likely surfaced this breach in days, not months.
- Enforce phishing-resistant MFA on every privileged and vendor account with cross-jurisdiction access. Apply conditional access: block legacy auth, require compliant devices for admin functions, and alert on impossible-travel and new-country sign-ins.
- Segment sealed records explicitly. Sealed documents should live behind separate authorization logic, separate storage, and ideally separate encryption keys, with every access logged and reviewed. If your platform can't demonstrate that, escalate it as an architectural risk.
- Review third-party/vendor remote access paths. Vendor support accounts are the perennial soft underbelly of hosted judicial platforms. Enforce just-in-time access, session recording, and named accounts — no shared vendor credentials.
- Update your IR plan for judicial-sector specifics: chain-of-custody for evidence that is itself court evidence, notification workflows that route through the Administrative Office of the Courts, and tabletop scenarios covering sealed-record exposure.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.