Arizona's court system says hackers copied residents' data without deploying ransomware
Arizona's Supreme Court says hackers copied personal data on "many Arizonans," with no ransomware deployed and no ransom demand as of Monday. For the people in those records, the risk now is direct misuse of the data, and no extortion talks are under way to show what the thieves intend.
The Watch · Security desk
What happened
- The Administrative Office of the Courts is working to alert as many people as possible whose information it believes the hackers copied.
- Chief Justice Ann Scott Timmer said the court will not release further details because they may affect the investigation into the attack.
- No hacking group has publicly taken credit for the attack.
- The court's alert page says official messages about the attack will arrive by email from one designated court address.
Why it matters
- Who's exposed exposure Breach notices are an easy template for phishing, and the court's page already tells readers it is not a scam, so a court email about the breach can be trusted only if it matches the designated sender.
- What it limits constraint Until the court publishes scope, people cannot tell which of their records were copied, so they cannot aim fraud protections at specific accounts or identifiers.
- Who has to decide decision Courts and agencies with incident plans built around ransomware outages need a way to spot bulk copying of records, since a theft like Arizona's has so far come with no encryption and no ransom note.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
"Court leaders believe the criminal hackers copied personally identifiable information about many Arizonans," Chief Justice Ann Scott Timmer said [3]. On method, the court has said only that the attackers were criminal hackers "or their bots" [2]. The court has not said how many people are affected, which data fields were copied, how the intruders got in, or when [8].
The ransom facts come from a court spokesperson. The spokesperson told Recorded Future News that the incident did not involve ransomware and that no demand had arrived as of Monday [7]. That covers three days after the Friday announcement [17]. Three days without a demand does not show what the thieves want, and it does not rule out a demand later. Timmer pointed to misuse of the records. "I personally spoke with the topranking FBI leader in the state, and I pledged our full commitment to supporting their investigation and minimizing the likelihood that the information will be used to further jeopardize Arizonans," she said [9].
Recorded Future News attributes the steady targeting of courts to the sensitive personal information and law enforcement data held on judicial servers [11]. The three recent cases it describes in detail were ransomware. In Kansas, a 2023 attack shut down nearly all of the state's courts, and full recovery took months [12]. In November, ransomware at the Pennsylvania Office of the Attorney General snarled that state's courts for nearly a month and forced time extensions in some criminal and civil cases [14]. The same month, ransomware hit the Georgia organization that manages real estate and civil court filings [15]. Courts in nine other states have faced ransomware, DDoS incidents or data breaches over the past four years [13][16].
Kansas, Pennsylvania and Georgia were outages. The job in each was getting systems back. Arizona's incident, as the court describes it, is a copy of records [3]. Copying data does not require taking a system offline, so there may be nothing to restore. The remaining work is finding which records left and reaching the people in them before the data is used.
What to watch
- A ransom demand or leak-site posting tied to the Arizona court data after the spokesperson's Monday statement.
- Notification letters or a regulatory filing from the court giving the number of people affected and the data fields copied.
- An FBI attribution to a named group, which would show whether this belongs to a wider campaign against courts or stands alone.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap0
- Incentives40
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Arizona Supreme Court announced on a Friday that the state's court system was attacked by hackers who stole the personal information of "many Arizonans."
- [2]
Chief Justice Ann Scott Timmer said in a statement that the state court system was targeted by criminal hackers "or their bots."
- [3]
"Court leaders believe the criminal hackers copied personally identifiable information about many Arizonans," Timmer said.
- [4]
"The Supreme Court's Administrative Office of the Courts is in the process of alerting as many people as possible whose information it believes the criminal hackers copied."
- [5]
The Arizona courts' cybersecurity alert page says official court communication regarding the cyber attack will be delivered via email from a designated court address.
- [6]
The Arizona courts' alert page says it was created to keep the public and those potentially affected informed, and states "This is not a scam."
- [7]
A spokesperson for the court system told Recorded Future News that the incident did not involve ransomware and the hackers had not issued ransom demands for the stolen data as of Monday.
- [8]
Timmer said the court would not release further details about the incident because they may impact the investigation into the attack.
- [9]
"I personally spoke with the topranking FBI leader in the state, and I pledged our full commitment to supporting their investigation and minimizing the likelihood that the information will be used to further jeopardize Arizonans," Timmer said.
- [10]
No hacking group has publicly taken credit for the attack.
- [11]
Court systems continue to bear the brunt of state-level cyberattacks due to the troves of sensitive personal information and law enforcement data held on judicial servers.
- [12]
A ransomware attack shut down nearly all of Kansas' court systems in 2023 and took months to fully resolve.
- [13]
State and municipal courts in California, Nebraska, South Carolina, Florida, Wisconsin, Louisiana, Ohio, Missouri and Illinois have faced ransomware attacks, DDoS incidents and data breaches over the last four years.
- [14]
In November, ransomware attackers breached the Pennsylvania Office of the Attorney General, snarling the state's court system for nearly a month and forcing courts to provide time extensions for certain criminal and civil cases.
- [15]
The organization responsible for managing real estate and civil court filings in Georgia was hit with ransomware in November.
- [16]
Recorded Future News names courts in nine states, beyond Kansas, Pennsylvania and Georgia, that faced attacks over the last four years.
- [17]
The spokesperson's no-demand statement covers the three days from the Friday announcement to Monday.
Sources
2 independent publishers whose own reporting we read for this story.
- Arizona Courts
azcourts.gov
1 article · September 29, 2026
- therecord.mediaArizona Supreme Court says hackers stole residents’ personal data
1 article · September 29, 2026
Topics and entities
Topics
- Ransomware
- Court system cybersecurity
- Data Breaches
Entities
- Arizona Administrative Office of the Courts
- Federal Bureau of Investigation
- Recorded Future News
- Ann Scott Timmer
- Arizona Supreme Court