Arizona Courts Say Hackers Copied Records on About 1.3 Million People

A phishing-linked attack on Arizona courts copied FARE and case records on about 1.3 million people, plus foster-care and protection-order files.

Arizona court officials said a cyberattack copied personal information from backup files of the statewide Fines/Fees and Restitution Enforcement (FARE) program, covering unpaid fees, fines, and restitution spanning about 30 years. The intrusion began Sept. 24 after an employee clicked a malicious email link and was announced Sept. 25; staff stopped the backup-server attack about two hours after spotting it. Exposed FARE data included names, Social Security numbers, and case numbers for 1.3 million people according to SecurityWeek, or more than 1.3 million according to The Record. Attackers also copied foster-care board reports dating to 2010—150,000 in one report and more than 150,000 in the other, including about 8,000 children currently in care—plus protection orders, which SecurityWeek put at nearly 30,000 while The Record said only that some were copied. Officials said it was not ransomware, no group has claimed responsibility or demanded a ransom, records were not altered, court cases were not delayed, and they have no evidence the stolen data was later used or shared.

• The intrusion began Sept. 24 after a court employee clicked a malicious email link and was announced Sept. 25; staff shut down the attack on a backup server about two hours after detecting it.
• Hackers copied backup files from the statewide Fines/Fees and Restitution Enforcement (FARE) program, exposing names, Social Security numbers, and case numbers tied to unpaid fees, fines, and restitution going back about 30 years.
• The affected population was reported as 1.3 million people by SecurityWeek and as more than 1.3 million by The Record.
• Attackers also copied Foster Care Review Board reports dating to 2010: 150,000 in one account and more than 150,000 in the other, including records on about 8,000 children currently in care.
• Protection-order files were taken as well; SecurityWeek reported nearly 30,000 active and inactive orders, while The Record described some protective-order records without a count.
• Officials said the incident was not ransomware, no group claimed it or demanded a ransom, records were not altered, cases were not delayed, and there is no evidence the data was later used or shared.