# Arizona Courts Cyberattack: Phishing-Led Intrusion Copies Backup Court Files Including Protective Order Data

> On 2026-09-24 attackers breached the Arizona Judicial Branch, reportedly via a phishing link clicked by a court employee, and copied backup court files containing personal data of many Arizonans, including addresses tied to active and inactive protective orders. Court IT shut the activity down in under two hours; the FBI is investigating and no group has claimed responsibility.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-10-07T21:22:14.679Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2768
- **ID:** TL-2026-2768
- **Severity:** CRITICAL
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Arizona Judicial Branch publicly disclosed on Friday 2026-09-25 (Chief Justice Ann Scott Timmer; 'URGENT NOTICE: Arizona Courts Experience Cyber Attack') that criminal hackers had targeted the state court system within the preceding ~36 hours and are believed to have copied personally identifiable information of 'many Arizonans'. The court's cybersecurity alert hub states the attack occurred on Thursday 2026-09-24 at around 11:30 a.m. and that court IT staff shut it down in less than two hours after identification. (One azfamily article dates the activity to 'last Thursday (September 25)'; the court's own hub says September 24, which this record uses. The Record's article carries a 2026-09-29 publish date and describes the announcement as a Friday; the court's release is dated 2026-09-25.)

Initial access: the court's hub page states the attack 'began with a common phishing attack, where a court employee received an email and clicked a malicious link'. Separately, Chief Justice Timmer told reporters that IT staff 'noticed unusual activity' involving large data transfers and that 'it appears that it's some type of automated bot that just went in and started hitting particular files'. Media reports quote officials saying there is no indication whether the access was random or targeted and that 'just large chunks of data is all we know at this point'. These accounts are not mutually exclusive (phishing-obtained access followed by automated bulk file access) but the court has published no technical detail reconciling them.

Data affected: per the court's hub, the copied files were backup court files containing a mix of public and non-public records, including active and inactive protective orders and some sensitive information ('much of the information is considered public'). Media reports (azfamily, KJZZ, Fox 10, NewsNation) emphasize names and confidential addresses of people with current or past protective orders, and domestic-violence victims are among those affected; azfamily reported tens of thousands of records. Officials said the format of the copied data makes it unclear whether most of it can easily be read, and that there is no evidence so far that the hackers have shared the data. The court states the copied files did not include information on jurors, witnesses, or court employees, and that no court records were deleted, altered or erased and pending cases and court dates are unaffected. No ransomware was involved and no ransom demand or group claim has been reported; The Record reports no operational disruption.

Response: the Administrative Office of the Courts began emailing affected individuals on Friday evening after business hours (the court stresses the notification email 'is not a scam'), reached out to domestic-violence shelters and advocacy groups, and posted updates at azcourts.gov/cybersecurityalert. Chief Justice Timmer personally spoke with the top-ranking FBI official in Arizona and pledged full support for the investigation; the court initiated a cybersecurity action plan. The court reports existing controls of a robust security policy, annual mandatory employee cybersecurity training, twice-yearly security scans, full-time cybersecurity staff and a 24/7 monitoring service.

Context: The Record lists prior US court-system attacks (Kansas 2023 ransomware that disabled nearly all court systems for months; incidents in California, Nebraska, South Carolina, Florida, Wisconsin, Louisiana, Ohio, Missouri and Illinois). NewsNation additionally references the 2026 Thomson Reuters C-Track case-management breach affecting other jurisdictions; Arizona is not among the reported affected jurisdictions and no source links the two incidents.

Gaps: the actor, the specific system holding the backup files, the number of affected individuals, the exact fields exposed and any network indicators (IPs, domains, hashes, phishing infrastructure) have not been published. Court details were withheld to protect the investigation and victims. This record documents only sourced facts and will need an update when attribution or technical details emerge.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1119 Automated Collection
- T1005 Data from Local System
- T1020 Automated Exfiltration

## Sources

- [Sept. 25, 2026 URGENT NOTICE: Arizona Courts Experience Cyber Attack (Arizona Judicial Branch news release)](https://www.azcourts.gov/Portals/0/201/Press%20Releases/2026/NewsReleaseArizonaCourtsExperienceCyberAttack.pdf)
- [Arizona Courts Cybersecurity Alert Information Hub](https://www.azcourts.gov/cybersecurityalert)
- [Arizona Supreme Court says hackers stole residents' personal data (The Record, Jonathan Greig)](https://therecord.media/arizona-supreme-court-says-hackers-stole-data)
- [Cyberattack targets Arizona courts, gaining personal information of 'many Arizonans' (KJZZ)](https://www.kjzz.org/kjzz-news/2026-09-26/cyberattack-targets-arizona-courts-gaining-personal-information-of-many-arizonans)
- [Cyberattack on Arizona courts may have exposed protective order addresses (azfamily)](https://www.azfamily.com/2026/09/26/cyberattack-arizona-court-system-may-have-exposed-personal-data-officials-say/)
- [Victim says Arizona court cyberattack has left her feeling 'vulnerable' (azfamily)](https://www.azfamily.com/2026/09/27/victim-says-arizona-court-cyberattack-has-left-her-feeling-vulnerable/)
- [Domestic violence victims' data may be exposed in Arizona court breach; FBI investigating (azfamily)](https://www.azfamily.com/2026/09/29/domestic-violence-victims-data-may-be-exposed-arizona-court-breach-fbi-investigating/)
- [Arizona court cyberattack under FBI investigation, potentially compromising personal data (Fox 10 Phoenix)](https://www.fox10phoenix.com/news/arizona-court-system-targeted-cyberattack-compromising-personal-records)
- [Arizona courts hit by cyberattack, personal data may be exposed (NewsNation)](https://www.newsnationnow.com/cybersecurity/arizona-courts-cyberattack-personal-data-exposed/amp/)
- [Thomson Reuters court software breach (The Hacker News) - related court-sector context only; no reported link to Arizona](https://thehackernews.com/2026/09/thomson-reuters-court-software-breach.html)
- [Thomson Reuters cyberattack data (The Record) - related court-sector context only; no reported link to Arizona](https://therecord.media/thomson-reuters-cyberattack-data)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2768