Short answer
The Arizona court system said an attack that began on 24 September 2026 let hackers copy backup court files. The court puts the FARE debt program exposure at about 1.3 million people and says it has no evidence the data was read or shared. It tells affected people to freeze their credit.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Arizona Supreme Court (Arizona court system) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | State courts and government |
| Country | United States |
| Detected | 2026-09-24 |
| Disclosed | 2026-09-25 |
| People or records affected | About 1.3 million people in the FARE debt program, plus more than 150,000 Foster Care Review Board reports, per the court |
What data was exposed
- Names, Social Security numbers and case numbers of about 1.3 million people in the Fines/Fees and Restitution Enforcement (FARE) program, with debts going back about 30 years
- More than 150,000 Foster Care Review Board reports dating to 2010, including information on children, family statements and investigative findings
- Active and inactive protective order records, including some sensitive information
What happened
The Arizona Supreme Court announced on 25 September 2026 that its court system had suffered a cyberattack that began the day before. Its IT team shut the affected system off entirely. In early October an updated court FAQ said federal and state investigators had confirmed that hackers “accessed and copied backup court files,” according to The Record.
KJZZ reported on 30 September that the court says the intrusion started with a phishing email and that the data came from a backup server. The court says no court records were deleted or altered.
What was copied
Three sets of data are involved, according to the court:
- FARE program records. FARE is the statewide Fines/Fees and Restitution Enforcement program, which helps collect debts from traffic and criminal violations. The data goes back about 30 years and includes names, Social Security numbers and case numbers for about 1.3 million people.
- Foster Care Review Board reports. More than 150,000 reports on current and past cases going back to 2010, including some 8,000 children currently in foster care. They hold information on children, family statements, investigative findings and administrative notes.
- Protective order records. Active and inactive orders, including some sensitive information.
The court’s figure for the FARE group is its own. It has not said how many people appear in the foster care and protective order files.
What the court says it does not know
The court says it has no evidence the data has been accessed, is readable or has been shared, and suggests the files may be difficult for attackers to read because of their format. That is an assessment, not a verified finding. As of The Record’s report, no ransom demand had been made and no hacking group had claimed responsibility. A court spokesperson earlier said the incident was not ransomware.
Response
Chief Justice Ann Scott Timmer is coordinating recovery with state officials and has spoken with the FBI’s Special Agent in Charge, Rebecca Day. The court says FARE-related people will get text messages and an insert in mailed collections notices, and it urges them to freeze or place a hold on their credit. It points people to identitytheft.gov and the Arizona Attorney General’s data breach page.
What to do if you have Arizona court debt or records
Because a Social Security number is the key item, a credit freeze is the most useful step. Court-themed scams also tend to follow breaches like this one, since attackers can quote real-sounding case details. Our guide to government impersonation scams and the warning signs of urgent payment demands cover the typical scripts.
Start with our data breach checklist, and read how to spot phishing messages, since phishing is how this attack reportedly began.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts or letters that claim to be the Arizona courts about an unpaid fine, fee or restitution balance and demand payment through a link, gift card or crypto.
- Calls or messages offering to 'fix' a court debt or credit problem for a fee, using details that look specific to your case.
- Identity theft attempts such as new credit applications made with a stolen Social Security number.
- Fake child-welfare or court-staff contacts aimed at families with foster care involvement.
What to do if you are affected
- 01Treat any text from the court as unverified until you confirm it. Go to azcourts.gov yourself rather than using a link in the message.
- 02Place a credit freeze or hold with Equifax, Experian and TransUnion, as the court advises.
- 03Use the FTC's identitytheft.gov and the Arizona Attorney General's data breach page at azag.gov/consumer/data-breach for next steps.
- 04Never pay a court debt by gift card, crypto or a payment link sent by text.
- 05Review your credit reports for accounts you did not open and place a fraud alert if you see any.
Frequently asked questions
Who is affected by the Arizona courts breach?
The court ties the roughly 1.3 million figure to people in the FARE program, which collects unpaid court-ordered debts from traffic, civil and criminal cases over about 30 years. Separate foster care and protective order records were also copied. Notices have gone to the Department of Child Safety, attorneys for parents, judges and review board members, according to The Record.
Was the data published or used?
The court says it has no evidence that any data has been accessed, is readable or has been shared, and that stolen files may be hard to read because of their format. That is the court's assessment, not an independent finding. As of The Record's report, no hacking group had claimed the attack and no ransom demand had been issued.
How will I know if I am affected?
The court says it is notifying FARE-related people by text message and will add information to mailed collections notices. Check the court's site directly if you are unsure, and do not click links in unexpected texts.
How did the attackers get in?
A court spokesperson said a court employee clicked a malicious link in a phishing email. The Record reports that this is the investigators' belief rather than a finding described as confirmed. The FBI is investigating.
Sources
- Arizona courts say hackers stole info on over 1 million, The Record from Recorded Future News, 2026-10-07
- Arizona Supreme Court breach exposed 1.3 million Social Security numbers, KJZZ, 2026-09-30
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.