ST. PAUL, September 3 — The Minnesota Judicial Branch has confirmed a major data breach after an unauthorized party hacked into backup data managed by its third-party technology vendor, Thomson Reuters Court Management Solutions. The incident occurred in March 2026 and was discovered in June 2026, exposing the technical reality that even judicial systems with stringent operational security can find their weakest points in vendor-managed infrastructure. The breach centered on C-Track, an appellate case-management platform used by judiciaries across multiple states and Canada.
Under the hood, this is a widely trusted system — which makes the compromise all the more significant for court administrators who outsource critical data handling. The affected institutions read like a roster of Minnesota’s appellate and administrative judiciary.
The Minnesota Supreme Court, the Court of Appeals, the Minnesota Tax Court, and the Office of Administrative Hearings in the executive branch all had data caught up in the incident. The detail that matters: actual court networks and daily operations were not shut down. The hackers reached backup data, not live systems.
What they may have obtained is nonetheless substantial. The stolen files could contain highly sensitive private details — names, Social Security numbers, driver’s license numbers, dates of birth, medical records, health insurance information, and some confidential or sealed court data.
As ever, the breadth of personal information held by courts makes them attractive targets, and the inclusion of sealed data raises particular concern about the integrity of judicial processes. Financial transaction systems were not impacted. General court orders or legal briefs were not part of the stolen data.
The Minnesota Judicial Branch moved swiftly on discovery, terminating Thomson Reuters’ access to its internal electronic environments and auditing all internal accounts. Users of the appellate courts’ case management system must now change their passwords; anyone attempting to use old credentials will be locked out. Thomson Reuters is offering 12 months of complimentary credit monitoring and identity theft protection services to individuals whose data was compromised.
State officials are reviewing the exposed data to determine exactly what information was compromised and what action they need to take next. For those seeking support, the dedicated channels are now live.
Affected individuals can email [email protected] or call the assistance line at 1-833-918-5294, providing the engagement number B171847. What to watch: whether other C-Track jurisdictions follow Minnesota’s lead in auditing their own vendor access arrangements, and how quickly the state completes its review of the actual data exposure. The judicial branch’s decision to sever Thomson Reuters’ internal access suggests a hardening stance on third-party risk — a posture other court systems may need to examine under the hood of their own contracts.
