Ontario courts warn personal data may be exposed after C-Track platform breach
Ontario's three chief justices said on Sept. 2 that personal information about people involved in court cases may have been exposed after an intruder accessed a cloud environment behind C-Track, the case management platform the province's courts use to store some documents and records.
The incident touches the Court of Appeal for Ontario, the Superior Court of Justice and the Ontario Court of Justice, and could involve anyone who was a party to a proceeding or was named in a court document.
What happened
According to the courts' public statement, Thomson Reuters Canada, which provides C-Track, detected unauthorized activity in one of its cloud environments on June 30. The company contained it, hired outside experts, notified police and secured the environment. On July 23, it told Ontario's Ministry of the Attorney General that the accessed data included some Ontario court information.
The statement was issued jointly by Chief Justice Michael Tulloch, Chief Justice Patrick Boucher of the Superior Court and Chief Justice Sharon Nicklas of the Ontario Court of Justice. They said there was no evidence so far of identity theft and no sign that systems handling court-related financial transactions were affected. C-Track remains in use, and the courts said their ability to hear cases has not been affected.
The courts said they are working with the Ontario government's Cyber Security Division. Thomson Reuters set up an information website at ctracknotification.ca and a toll-free call centre that was scheduled to open on Sept. 4, Global News reported.
What we don't know yet
The exact contents of the accessed files, the types of information involved at each court and the number of people affected are still under investigation. Neither the courts nor the vendor has said how the intruder got in or who was responsible.
Why it matters
Court files can hold addresses, financial details, family matters and criminal allegations. More than two months passed between detection and public notice, and nearly six weeks between detection and the vendor telling the ministry that court data was involved.
What to do
People involved in Ontario court proceedings can check ctracknotification.ca, should treat unsolicited messages that reference their case with caution, and should confirm any request for payment or information directly with the court office.
