Arizona’s court system says attackers copied data on 1.3 million people, along with protection-order and foster-care records. A malicious-email click is the suspected entry point.
AI-generated conceptual illustration of the suspected phishing entry point; investigators have not established the cause. No real person or record is depicted.
The Arizona court system says staff shut down the attack about two hours after detecting it. That response time does not establish when the intrusion began or how long data copying lasted.[4]
The Arizona Supreme Court told the Associated Press that attackers copied personal information tied to 1.3 million people with unpaid court fees, fines and restitution obligations. Some records stretched back 30 years.[4]
The haul also included nearly 30,000 active and inactive protection orders and 150,000 foster-care reports dating to 2010. The attack is believed to have started when a court employee clicked a malicious link in an email.[4]
A suspected malicious click. Three decades of records. The paperwork equivalent of leaving the courthouse archive on the curb with a sign reading “please be discreet.”
The court says technology staff shut down the attack on a backup server roughly two hours after detecting it on September 24. A spokesperson said there was no evidence the copied data had been used or shared. No records were altered or deleted, court proceedings were not delayed, and juror, witness and employee data was not taken.[4]
Those qualifications matter. This is not evidence that protection-order information is circulating publicly or that anyone has been harmed because of the breach.[4]
Fact and inference
The facts are the court’s reported counts, the suspected phishing entry point, the two-hour response after detection and the current absence of evidence that the data was used or shared. The inference is that retention became attack surface. Thirty years of debt records and sixteen years of foster-care reports left a very deep shelf for attackers to empty.[4]
“Human error” is a convenient label. It leaves the harder question: which access controls and retention choices let attackers reach records whose disclosure may carry consequences far beyond identity theft?
Two hours from detection to containment. The archive took decades to build. Very efficient, in the worst possible direction.
CORRECTIONS & UPDATES.
Correction · Clarification, October 8, 2026: A malicious-email click remains the suspected entry point, and the reported two hours ran from detection to containment. The title, copy and illustration no longer imply a proven single-click mechanism, a known compromised account or the attack’s total duration.
FOLLOW THE SOURCES.
Checked Oct 8, 2026. Numbered references point to the evidence behind factual passages. Commentary is our own.