West Publishing’s C-Track Data Breach

A four-month intrusion into a court records platform used by appellate and trial courts in a dozen states may have exposed not just names and Social Security numbers, but confidential and sealed court files, including sensitive family and juvenile matters.

West Publishing Corporation, a Thomson Reuters subsidiary that operates the C-Track court case management platform, has confirmed a data breach affecting court systems in at least twelve states, the U.S. Virgin Islands, and Ontario, Canada. According to the company’s public notice, an unauthorized party accessed a storage location within C-Track’s environment between March 1 and June 29, 2026. C-Track discovered the intrusion on June 30, 2026, and issued public notice on September 2, 2026, 64 days later.

Affected court systems named in the notice include appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, Oregon, South Carolina, Tennessee, and Wyoming, along with several Pennsylvania courts, ten Ohio district courts of appeals, and the U.S. Virgin Islands Supreme and Superior Courts. No population figure has been disclosed. Because the affected systems held records for every litigant, victim, witness, and juror whose case passed through them, the number of people involved is likely to be very large even though it has not been quantified.

A Private Company, Not a Court, Is the Defendant Here

This case is structured differently from most court-records exposures. The courts themselves are not the defendant. West Publishing Corporation is a private, for-profit subsidiary of Thomson Reuters, and every affected court that has spoken has said the breach occurred within West Publishing’s own systems, not the courts’ own networks. That means a claim in this case runs against a solvent private company rather than a government body that might otherwise be shielded by sovereign immunity.

What Kind of Information Was Exposed?

C-Track’s notice confirms the following categories of information may have been affected:

• Full name
• Social Security number
• Driver’s license number
• Date of birth
• Medical information
• Health insurance information
• Confidential, redacted, or sealed court records, for certain affected courts

C-Track has acknowledged that sealed and confidential filings may have been affected at some of the courts on the list. Independent reporting on this incident indicates that sealed records at some courts can include juvenile proceedings, family law cases involving minor children, and expunged criminal records, categories of case file that are sealed specifically because of how sensitive they are. Emery | Reddy is not aware of any itemized, court-by-court list of exactly which sealed case types were affected at which location, and this post will be updated if one becomes available.

A Notification Method Worth Questioning

C-Track states it notified individuals through a website posting and media notice rather than direct letters. That approach, known as substitute notice, is typically reserved for situations where an organization does not have contact information for the people affected, or where the size of the class makes individual notice impractical. Here, the courts themselves hold the names and addresses of the litigants, witnesses, and other individuals in their own case files. New Hampshire’s Judicial Branch has confirmed it was able to identify names and addresses from its own affected case files. Whether substitute notice was an appropriate choice, rather than direct mail to identifiable individuals, is an open legal question.

What Is West Publishing Offering?

West Publishing is offering 12 months of complimentary identity protection services through Experian IdentityWorks. Information on the offer and further updates are available through the company’s dedicated notification website. The company states it has no evidence to date that the incident has resulted in actual fraud or misuse of information.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that hold this information are legally required to safeguard it. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Some of the information involved in this incident, including medical and health insurance information, may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Do You Have Legal Options?

Companies that store sensitive court records, including sealed and confidential filings, have a legal duty to safeguard that information. Individuals whose case records passed through an affected court system may have rights and remedies under applicable law, including claims tied to the choice to rely on substitute notice rather than direct notification.

If you were a party, witness, victim, or juror in a case handled by an affected court and believe your information was involved, contact the Data Breach Attorneys at Emery | Reddy for a Free Case Review.

Frequently Asked Questions

How do I know if my court case was affected?

West Publishing has not published an individual notification list. If your case was handled by one of the affected appellate or trial court systems, including courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, Oregon, Pennsylvania, South Carolina, Tennessee, Wyoming, Ohio, or the U.S. Virgin Islands, during the period the platform was in use, your records may have been involved.

How many people were affected?

West Publishing has not disclosed a population figure. Given that the affected systems held case records for entire court systems over an extended period, the number is likely to be large but has not been quantified.

Were sealed or confidential court records really exposed?

West Publishing’s own notice states that confidential, redacted, or sealed information may have been impacted at certain affected courts. Independent reporting indicates sealed records at some courts can include sensitive matters such as juvenile proceedings and family law cases involving minor children. West Publishing has not published a detailed, court-by-court breakdown of exactly what sealed material was involved.

Why did West Publishing only post a website notice instead of mailing letters?

West Publishing has described its notice as a website and media notice, a form of substitute notice. Whether that was appropriate here, given that the affected courts hold identifying information for the people in their own case files, is a central question in this investigation.

Is West Publishing offering identity protection?

Yes. West Publishing is offering 12 months of complimentary identity protection through Experian IdentityWorks, described on its dedicated incident notification website.

Do I have a legal claim?

You may. Companies entrusted with sensitive court records, including sealed and confidential filings, are required by law to protect that information and to notify affected individuals appropriately. Contact the Data Breach Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.