Skip to navigation

Threat reportData BreachTL-2026-2768

Arizona Courts Cyberattack: Phishing-Led Intrusion Copies Backup Court Files Including Protective Order Data

criticalACTIVE

On 2026-09-24 attackers breached the Arizona Judicial Branch, reportedly via a phishing link clicked by a court employee, and copied backup court files containing personal data of many Arizonans, including addresses tied to active and inactive protective orders. Court IT shut the activity down in under two hours; the FBI is investigating and no group has claimed responsibility.

Key facts

IdentifiersTL-2026-2768
Also known asArizona Courts Cyber Attack, Arizona Judicial Branch data breach
SeverityCRITICAL
Affected productsArizona Judicial Branch Arizona state court system backup court files (protective orders and other court records)
MITRE ATT&CK techniquesT1005 Data from Local System, T1020 Automated Exfiltration, T1119 Automated Collection, T1204.001 Malicious Link, T1566.002 Spearphishing Link
MotivationUNKNOWN
Target sectorsgovernment administration, judiciary, legal
Target regionsNorth America, united states of america, Arizona
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage

As of 2026-10-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2768 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Bulk Distinct File Reads From Backup Share by One Account — Post-Exploitation Collection

Detects one account or source host reading a very large number of distinct files from a backup, archive or .bak share within 10 minutes (Windows event 5145). The Arizona courts reported an 'automated bot' hitting particular files and copying backup court files containing protective-order data; scripted bulk reads of a backup repository are the key monitoring point named in the research.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1119, T1005, T1039
  • Data sources: windows_security, wineventlog
  • Severity: high
  • Confidence: medium

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" EventCode=5145 earliest=-1h
(Share_Name="*backup*" OR Share_Name="*bak*" OR Share_Name="*archive*")
| bin _time span=10m
| stats dc(Relative_Target_Name) as distinct_files count as operations values(Source_Address) as src_ips values(Share_Name) as shares by _time, Account_Name
| where distinct_files > 500
| sort - distinct_files

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 5145
| where ShareName has_any ("backup", "bak", "archive")
| summarize DistinctFiles = dcount(RelativeTargetName), Operations = count(), Shares = make_set(ShareName) by bin(TimeGenerated, 10m), SubjectUserName, IpAddress
| where DistinctFiles > 500
| order by DistinctFiles desc

Sigma

name: tl_backup_share_file_access
title: File Access on Backup or Archive Share
id: 4e8a1c76-0d35-4b92-a7f3-6c1b9e2d5a04
status: experimental
description: Base rule matching detailed file share access (5145) on shares whose name suggests backups or archives. Intended to be consumed by the bulk-access correlation rule below.
references:
  - https://www.azcourts.gov/cybersecurityalert
author: Threadlinqs Team
date: 2026-09-29
tags:
  - attack.collection
  - attack.t1005
  - attack.t1119
  - attack.t1039
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName|contains:
      - 'backup'
      - 'bak'
      - 'archive'
  condition: selection
falsepositives:
  - Backup software service accounts
level: informational
---
title: Bulk Distinct File Reads From Backup Share
id: 91d2f0b8-3a47-4c1e-b5d6-8e7f2a4c6b14
status: experimental
description: Fires when a single account and source address touches 500 or more distinct files on a backup or archive share within 10 minutes, matching the scripted bulk access to backup court files reported for the Arizona Judicial Branch breach.
author: Threadlinqs Team
date: 2026-09-29
tags:
  - attack.collection
  - attack.t1119
  - attack.t1005
  - attack.t1039
correlation:
  type: value_count
  rules:
    - tl_backup_share_file_access
  group-by:
    - SubjectUserName
    - IpAddress
  timespan: 10m
  condition:
    gte: 500
    field: RelativeTargetName
falsepositives:
  - Backup, AV or indexing service accounts scanning backup shares
level: high

Known false positives:

  • Backup, antivirus or indexing service accounts legitimately sweeping backup shares

Tuning notes: Requires 'Audit Detailed File Share' enabled on file servers hosting backups. Exclude backup service accounts and tune the 500-file threshold to the share's normal profile. The court has not said what system held the backup files, so extend the share-name filters to match your backup repository naming.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Webmail-Referred Navigation to Newly Registered or Uncategorized Site — Exploitation · unlock with TL Creds
  • Scripted High-Volume Requests to Records or File Web Endpoints — Post-Exploitation Collection · unlock with TL Creds
  • Server Sends Large Volume to Never-Before-Seen External Destination — Exfiltration · unlock with TL Creds
  • Mail or Browser Process Spawning Script Interpreter (User Execution After Link Click) — Exploitation · unlock with TL Creds
  • Bulk Copy or Archive of Backup Files With File-Copy Tooling — Post-Exploitation Collection · unlock with TL Creds
  • Upload-Capable Transfer Tools Run on Servers (rclone, azcopy, curl, aws s3, PowerShell) — Exfiltration · unlock with TL Creds
  • Outlook-Launched Browser With External URL (Phishing Link Click-Through) — Exploitation · unlock with TL Creds
  • Server Hourly Outbound Volume Far Above Its 30-Day Baseline — Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-10-07, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-2768.

Sample indicators (1 of 11)

  • Domain: azcourts[.]gov

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

11 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The Arizona Judicial Branch publicly disclosed on Friday 2026-09-25 (Chief Justice Ann Scott Timmer; 'URGENT NOTICE: Arizona Courts Experience Cyber Attack') that criminal hackers had targeted the state court system within the preceding ~36 hours and are believed to have copied personally identifiable information of 'many Arizonans'. The court's cybersecurity alert hub states the attack occurred on Thursday 2026-09-24 at around 11:30 a.m. and that court IT staff shut it down in less than two hours after identification. (One azfamily article dates the activity to 'last Thursday (September 25)'; the court's own hub says September 24, which this record uses. The Record's article carries a 2026-09-29 publish date and describes the announcement as a Friday; the court's release is dated 2026-09-25.)

Initial access: the court's hub page states the attack 'began with a common phishing attack, where a court employee received an email and clicked a malicious link'. Separately, Chief Justice Timmer told reporters that IT staff 'noticed unusual activity' involving large data transfers and that 'it appears that it's some type of automated bot that just went in and started hitting particular files'. Media reports quote officials saying there is no indication whether the access was random or targeted and that 'just large chunks of data is all we know at this point'. These accounts are not mutually exclusive (phishing-obtained access followed by automated bulk file access) but the court has published no technical detail reconciling them.

Data affected: per the court's hub, the copied files were backup court files containing a mix of public and non-public records, including active and inactive protective orders and some sensitive information ('much of the information is considered public'). Media reports (azfamily, KJZZ, Fox 10, NewsNation) emphasize names and confidential addresses of people with current or past protective orders, and domestic-violence victims are among those affected; azfamily reported tens of thousands of records. Officials said the format of the copied data makes it unclear whether most of it can easily be read, and that there is no evidence so far that the hackers have shared the data. The court states the copied files did not include information on jurors, witnesses, or court employees, and that no court records were deleted, altered or erased and pending cases and court dates are unaffected. No ransomware was involved and no ransom demand or group claim has been reported; The Record reports no operational disruption.

Response: the Administrative Office of the Courts began emailing affected individuals on Friday evening after business hours (the court stresses the notification email 'is not a scam'), reached out to domestic-violence shelters and advocacy groups, and posted updates at azcourts.gov/cybersecurityalert. Chief Justice Timmer personally spoke with the top-ranking FBI official in Arizona and pledged full support for the investigation; the court initiated a cybersecurity action plan. The court reports existing controls of a robust security policy, annual mandatory employee cybersecurity training, twice-yearly security scans, full-time cybersecurity staff and a 24/7 monitoring service.

Context: The Record lists prior US court-system attacks (Kansas 2023 ransomware that disabled nearly all court systems for months; incidents in California, Nebraska, South Carolina, Florida, Wisconsin, Louisiana, Ohio, Missouri and Illinois). NewsNation additionally references the 2026 Thomson Reuters C-Track case-management breach affecting other jurisdictions; Arizona is not among the reported affected jurisdictions and no source links the two incidents.

Gaps: the actor, the specific system holding the backup files, the number of affected individuals, the exact fields exposed and any network indicators (IPs, domains, hashes, phishing infrastructure) have not been published. Court details were withheld to protect the investigation and victims. This record documents only sourced facts and will need an update when attribution or technical details emerge.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection

Exfiltration

T1020 Automated Exfiltration

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Remediation

Immediate actions

  • Individuals with current or past protective orders who fear for their safety should contact local law enforcement; the Arizona 24-hour domestic abuse hotline cited by the court is 602-269-2980
  • Treat court notification emails as legitimate only when they match the notice at azcourts.gov/cybersecurityalert; the court states its notification emails are not a scam
  • Court and government staff: report and quarantine emails with unexpected links, and reset credentials for any user who clicked a suspicious link
  • Review egress and access logs for bulk reads of backup file stores and unusually large outbound transfers around 2026-09-24

Longer-term hardening

  • Restrict and monitor access to backup repositories containing non-public court records; apply least privilege and separate backup credentials
  • Deploy phishing-resistant MFA and link-protection/detonation on judicial-branch email
  • Encrypt backups at rest so copied files are unreadable without separately held keys
  • Alert on automated, high-volume file access and large data transfers from records systems

Affected and fixed versions

  • Arizona Judicial Branch — Arizona state court system backup court files (protective orders and other court records)

Timeline

Last updated · revalidated 1× · latest source

  • Backup court files containing a mix of public and non-public records, including active and inactive protective orders, were copied; no records were deleted, altered or erased.
  • Court IT staff noticed unusual activity and large data transfers ('some type of automated bot... hitting particular files') and shut the attack down in less than two hours.
  • Per the court's alert hub, the attack began with a phishing email in which a court employee clicked a malicious link; the attack occurred around 11:30 a.m.
  • The Administrative Office of the Courts began emailing affected individuals after business hours on Friday and pointed the public to locked-ioc-3 updates.
  • Timmer spoke personally with the top-ranking FBI official in Arizona and pledged full support for the FBI investigation.
  • Chief Justice Ann Scott Timmer announced that criminal hackers likely copied personal identifying information of 'many Arizonans'; the Judicial Branch issued an urgent notice.
  • The court's cybersecurity alert information hub at locked-ioc-3/cybersecurityalert was posted with the phishing attack description, data scope and the exclusion of juror, witness and employee data.
  • Local media reported that confidential addresses of people with current or past protective orders may have been copied; officials said no evidence the data was shared and it is unclear whether most copied data is readable.
  • azfamily reported an affected protective-order holder describing feeling vulnerable after being told her information and location may have been copied.
  • Court disclosed that 150,000+ confidential Foster Care Review Board reports dating to 2010 were among the copied data.
  • azfamily reported tens of thousands of records affected including domestic-violence victims, with outreach to shelters and advocacy groups; The Record reported no ransomware, no ransom demand and no group claim.
  • Court confirmed the FARE program breach: about 1.3 million individuals' names, case numbers and Social Security numbers across 30 years of court-debt records; text and mailed notifications began.
  • Updated court FAQ published; no group has claimed responsibility, no ransom demand reported, FBI investigation continues.

Update history

Sources cited

Previous and next in data breach

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats