Thomson Reuters unit says Ontario court files were taken in C-Track breach

C-Track Canada, the court case management business owned by Thomson Reuters Canada Limited, says an unauthorized party obtained files from its systems in March that relate to three Ontario courts, and that some of the records may include confidential, redacted or sealed information.

The breach shows how a single software vendor can become the weak point for institutions that handle highly sensitive material. Court records can hold names, health details and information that a judge has ordered kept from public view.

What happened

According to C-Track Canada's notification site, the company discovered unauthorized activity on June 30, 2026, and its investigation found that a third party had obtained certain files in March. The affected courts are the Court of Appeal for Ontario, the Ontario Superior Court of Justice and the Ontario Court of Justice. The company says a subset of court records was involved, some of which may contain individuals' names and personal information.

The company says the incident did not originate in the courts' own networks, that there is no evidence systems used for financial transactions were affected, and that it has seen no fraud or misuse of the information so far. It says it brought in outside experts and law enforcement, contained the activity and added security measures.

The Ontario breach is part of a wider incident. The Record reported that courts in at least 12 U.S. states and the U.S. Virgin Islands were also affected. The chief justices of the three Ontario courts issued a joint statement, and the Ontario Ministry of the Attorney General was told of the access on July 23, according to the report. In the U.S., the company said exposed data could include Social Security numbers, driver's licence numbers and medical information, though details vary by court.

What we don't know yet

Thomson Reuters has not said how the attacker got in, who was responsible, how much data was taken or how many people are affected. No group has publicly claimed the attack.

What to do

People who receive a notice can enrol in a free 12-month myTrueIdentity credit monitoring subscription from TransUnion Canada using the activation code in their letter; the notice says enrolment closes Dec. 31, 2026. Anyone involved in a case before these courts should be alert to messages that cite case details to gain trust.