Ontario's court system has become the latest high-profile target in a cybersecurity incident involving sensitive legal records and personal information.
In September 2026, Ontario's three chief justices warned that personal information belonging to people involved in court proceedings may have been accessed during a cyberattack involving C-Track, an online case management platform operated by Thomson Reuters Canada Limited. The platform is used by the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice to store and manage certain court documents and records.
The incident is significant not only because courts routinely handle highly sensitive information, but because it illustrates a broader cybersecurity challenge facing governments, law firms, healthcare organizations, and other institutions: the security of an organization's data increasingly depends on the security of its technology vendors.
While the investigation remains ongoing and the precise scope of the incident has not yet been determined, the Ontario courts' response provides several important lessons about third-party risk, cloud security, access controls, incident detection, and the protection of sensitive data.
The cybersecurity incident involves Thomson Reuters' C-Track case management platform.
According to a September 2 public statement from Ontario's three chief justices, Thomson Reuters detected unauthorized activity within one of its cloud environments on June 30th, 2026. The company responded by containing the activity, engaging external cybersecurity experts, notifying law enforcement, and securing the C-Track environment.
A subsequent investigation determined that an unauthorized party had obtained certain C-Track files in March 2026, meaning the compromise occurred months before it was detected. Thomson Reuters subsequently determined that some of the affected files were associated with Ontario's courts.
The Ontario Ministry of the Attorney General was notified about the affected Ontario court data on July 23rd.
The incident affected three major Ontario courts:
Court of Appeal for Ontario
Ontario Superior Court of Justice
Ontario Court of Justice
C-Track is used to manage digital court records and documents, making it a particularly sensitive system from a cybersecurity perspective. Thomson Reuters has said the incident occurred within its own cloud environment rather than as a result of a compromise of the Ontario courts' networks.
Importantly, the courts have said there has been no operational disruption and that C-Track remains safe to use. There is also currently no evidence that the incident has resulted in identity theft, and no indication that systems processing financial transactions associated with court proceedings were affected. However, that does not mean the incident is inconsequential.
The investigation is still determining exactly what information was accessed and how many individuals could be affected.
One of the biggest concerns surrounding the Ontario courts cyberattack is the sensitivity of the information contained in court records.
The Ontario courts have emphasized that they do not yet know the exact content of all files that may have been accessed. As a result, they cannot yet provide a definitive list of affected information or individuals.
Anyone involved in a court proceeding, or even someone mentioned in a court document, could potentially have personal information included in the affected records.
The broader C-Track incident has involved court records that may contain highly sensitive information. Reporting on affected U.S. jurisdictions indicates that potentially exposed information can include names, dates of birth, driver's license information, medical information, health insurance information, and Social Security numbers. Some affected court systems have also raised concerns about confidential, redacted, or sealed material.
The precise categories of information involved in Ontario remain under investigation.
That distinction is important.It would be inaccurate to assume that every person who has interacted with an Ontario court had their information stolen. At this stage, the courts are warning that personal information may have been involved, while investigators work to determine the precise scope.
A cybersecurity incident involving ordinary business information can be disruptive. A breach involving court records can be considerably more consequential.
Court systems may contain information about:
Plaintiffs and defendants
Accused individuals
Victims and witnesses
Lawyers and legal representatives
Children and families
Medical circumstances
Financial disputes
Criminal allegations
Family law matters
Personal addresses and contact information
Confidential evidence
Sealed or restricted records
Even information that appears relatively ordinary in isolation can become highly sensitive when combined with other data.
For example, a person's name, address, date of birth, legal dispute, employment information, and medical history could collectively create a detailed profile that could be exploited for fraud, social engineering, harassment, or other malicious activity.
This is why cybersecurity in the legal sector cannot be reduced to protecting passwords or preventing ransomware. The confidentiality, integrity, and availability of legal information are fundamental to public trust in the justice system.
Perhaps the most important lesson from the Ontario courts cyberattack is the risk created by third-party technology providers.
Organizations increasingly depend on vendors to provide:
Cloud infrastructure
Case management platforms
Customer relationship management systems
Document management
Data storage
Authentication
Payment processing
Security monitoring
Software development platforms
This allows organizations to operate more efficiently, but it also expands their attack surface.
A company can have strong internal security controls and still be affected by a vulnerability or compromise within a vendor's environment.
The Ontario courts' incident demonstrates this distinction clearly. The affected platform was operated by Thomson Reuters, while the organizations whose information was stored within the platform included Ontario's courts.
As one Canadian legal cybersecurity expert told National Magazine, organizations need to pay close attention to the cybersecurity practices of their vendors and ensure contractual protections and security controls adequately protect outsourced data. This is commonly referred to as third-party risk or supply chain risk.
Traditional cybersecurity programs often focus heavily on an organization's own infrastructure.
That approach is no longer enough.
A comprehensive security strategy needs to consider what happens when sensitive information leaves an organization's direct environment.
Before engaging a technology provider, organizations should understand:
What data will the vendor receive?
Where will that data be stored?
Who can access it?
How is privileged access controlled?
How is suspicious activity detected?
How quickly will the organization be notified of a breach?
What security testing does the vendor perform?
What happens to the data when the contract ends?
How are subcontractors managed?
What evidence exists that security controls actually work?
Security questionnaires can provide useful information, but they should not be treated as a substitute for meaningful validation.
An organization may have policies, certifications, security documentation, and contractual commitments while still having exploitable weaknesses.
That is where independent security testing becomes particularly valuable.
Another significant issue highlighted by the C-Track incident is the gap between initial compromise and detection.
Thomson Reuters detected unauthorized activity on June 30, while its investigation determined that an unauthorized party had obtained certain files in March.
That creates an important cybersecurity question: How long could an attacker operate inside an environment before being detected?
An attacker does not necessarily need to deploy ransomware or cause an obvious outage to create significant damage.
A threat actor may instead attempt to:
Obtain credentials
Escalate privileges
Access cloud resources
Locate sensitive databases
Download files
Establish persistence
Move laterally
Disable security controls
Extract information gradually
This is why security teams need visibility into suspicious behavior rather than relying exclusively on malware signatures or obvious indicators of compromise.
Cloud environments can provide significant security advantages, but moving systems to the cloud does not eliminate cybersecurity risk.
Organizations still need to understand:
Identity and access management
Privileged accounts
Authentication controls
API security
Logging
Monitoring
Data encryption
Network segmentation
Configuration management
Detection and response
Vendor access
Backup and recovery
Cloud security is ultimately a shared responsibility.
A secure cloud platform does not automatically mean every application, identity, configuration, integration, or third-party connection within that platform is secure.
The C-Track incident demonstrates why organizations should evaluate the security architecture surrounding their cloud-hosted applications rather than assuming that a reputable vendor eliminates the need for independent oversight.
One way organizations can strengthen third-party risk management is through penetration testing.
A penetration test can help identify vulnerabilities that may not be obvious from documentation or compliance questionnaires.
Depending on the environment and objectives, testing can examine areas such as:
External attack surfaces
Web applications
APIs
Cloud infrastructure
Authentication mechanisms
Privileged access
Network segmentation
Identity systems
Security controls
Detection and response capabilities
For organizations that store sensitive information with external providers, security assessments can also help determine whether the controls protecting that information would withstand realistic attack techniques.
The objective is not simply to find vulnerabilities.
It is to understand what an attacker could realistically accomplish if a vulnerability were exploited.
That distinction matters because a low-severity technical issue can sometimes become a high-impact business risk when combined with weak authentication, excessive privileges, poor segmentation, or insufficient monitoring.
The incident provides several practical cybersecurity lessons for organizations in both the public and private sectors.
If a vendor stores or processes your sensitive information, its security posture affects your organization.
Third-party risk should therefore be incorporated into the organization's broader security strategy.
Not all data carries the same consequences if compromised.
Legal records, medical information, financial information, credentials, and personally identifiable information should receive appropriate security controls based on their sensitivity.
Organizations should assume that attackers may eventually bypass preventive controls.
Security monitoring and detection capabilities can reduce the amount of time an attacker has to operate undetected.
The principle of least privilege limits what an attacker can access if an account or system is compromised.
Organizations should regularly review privileged accounts, vendor access, service accounts, and permissions.
A third-party breach can quickly become your organization's incident.
Contracts and incident response plans should establish clear responsibilities for notification, investigation, evidence preservation, communications, containment, and remediation.
Organizations should not rely solely on questionnaires or vendor assurances.
Independent assessments, penetration testing, configuration reviews, and other forms of security validation can provide a more realistic understanding of risk.
Ontario has been actively modernizing its court infrastructure.
The province's Justice Accelerated Strategy is intended to replace legacy processes and expand digital services. Ontario's Courts Digital Transformation initiative introduced the Ontario Courts Public Portal for various Toronto proceedings beginning in October 2025, with additional digital transformation planned.
Digital transformation can make the justice system faster, more accessible, and more efficient.
It also creates new cybersecurity responsibilities.
As more court processes move online, the consequences of a successful cyberattack can extend beyond a single application. Digital systems increasingly connect filing, case management, document sharing, scheduling, communications, and other functions.
That means cybersecurity needs to be incorporated into digital transformation from the beginning rather than treated as an additional layer after deployment.
The Ontario courts have said Thomson Reuters established a dedicated information website and planned a Canadian toll-free call center for individuals seeking information about the incident. People who believe they may have been involved in an affected court proceeding should follow official updates rather than relying on social media speculation or unsolicited messages.
It is also important to remain alert for phishing attempts.
Cybercriminals can exploit news of a breach by impersonating organizations involved in the incident. Someone could receive a fraudulent email or text claiming to offer information about the breach while actually attempting to collect passwords, financial information, identification numbers, or other sensitive data.
Individuals should be cautious about unexpected requests for personal information and verify communications through official channels.
The Ontario courts cyberattack is still being investigated, and many important questions remain unanswered.
Exactly which records were accessed? How many individuals are affected? What information was contained in those files? How did the unauthorized party gain access? And what controls could have prevented or detected the activity sooner?
Those questions will become clearer as the investigation progresses.
For organizations outside the justice system, however, the broader lesson is already apparent.
Cybersecurity does not stop at the edge of your own network.
When sensitive information is stored in a third-party application or cloud environment, that vendor effectively becomes part of your security perimeter. Vendor selection, access controls, security testing, monitoring, incident response, and ongoing validation therefore need to be treated as interconnected components of an organization's cybersecurity program.
The Ontario courts' increasing reliance on digital systems makes that responsibility even more important.
Digital transformation can improve how organizations operate, but convenience cannot come at the expense of security. As sensitive information moves into increasingly interconnected environments, organizations need to continuously test whether their defenses work against the techniques a real attacker would use.
The Ontario court records incident is a reminder that trusting a technology provider is not the same as validating its security.
For organizations handling sensitive information, that distinction can make all the difference.
Ontario courts were affected by a cybersecurity incident involving C-Track, a case management platform operated by Thomson Reuters Canada. Thomson Reuters detected unauthorized activity on June 30, 2026, and later determined that an unauthorized party had obtained certain C-Track files in March. (
The affected Ontario courts are the Court of Appeal for Ontario, the Ontario Superior Court of Justice, and the Ontario Court of Justice. All three use C-Track to store and manage certain court documents and records.
The courts have said that personal information may have been involved, but the full scope of the incident remains under investigation. Authorities have not yet determined exactly which Ontario records were accessed or how many individuals may be affected.
Thomson Reuters detected unauthorized activity on June 30, 2026. Its investigation determined that an unauthorized party had obtained certain C-Track files in March 2026.
Ontario's chief justices said Thomson Reuters has implemented mitigation measures and additional security enhancements and has advised that C-Track remains operational and safe to use.
At the time of the Ontario courts' public statement, Thomson Reuters had found no evidence that the incident had resulted in identity theft. The investigation remains ongoing.
There was no indication at the time of the public statement that systems used to process financial transactions relating to court proceedings had been affected.
The incident highlights the cybersecurity risks associated with third-party technology providers. Organizations can have strong internal controls while still being exposed through a vendor that stores, processes, or manages their data.
Organizations should assess vendors before granting access to sensitive information, establish strong contractual security requirements, review access privileges, monitor third-party connections, conduct appropriate security testing, and maintain an incident response plan that accounts for vendor-related breaches.
Our Penetration Security Testing methodology is derived from the SANS Pentest Methodology, the MITRE ATT&CK framework, and the NIST SP800-115 to uncover security gaps.
Download our Pentest Sourcing Guide to learn everything you need to know to successfully plan, scope, and execute your penetration testing projects.
Ontario courts were affected by a cyberattack involving Thomson Reuters' C-Track case management platform. Learn what happened, what data may be exposed, and what organizations can learn from the breach.
September 11, 2026 - Blog
CREST’s new AI-enabled penetration testing accreditation establishes standards for responsible AI use. Learn what it means for pentesting and Packetlabs.
September 04, 2026 - Blog
Explore five of the biggest cyber attacks of 2026, including Cisco SD-WAN, Ivanti EPMM, Stryker, and ShinyHunters attacks, and learn what DNS threat intelligence reveals.
August 25, 2026 - Blog