Ontario Courts’ case management system hacked

Log in to listen to this article

A cyberattack has potentially exposed sealed information and sensitive personal data at Ontario’s courts. 

On Wednesday, Thomson Reuters said the breach of its C-Track case management platform in June has impacted courts in at least 12 U.S. states, the U.S. Virgin Islands, and Canada.

“On June 30, 2026, Thomson Reuters detected unauthorized activity within one of its cloud environments,” the chief justices of Ontario’s three courts said in a statement.

“We are advised that Thomson Reuters responded by taking steps to contain the activity, engaging external cybersecurity experts to advise and investigate, notifying law enforcement, and securing the C-Track environment.”

The courts and Ontario’s Attorney General were notified on July 23, triggering consultations with Thomson Reuters and the province’s cybersecurity experts to determine the incident’s nature and scope and assess potential implications for court users. So far, there’s no evidence of any identity theft. Thomson Reuters says that mitigation measures have been put in place while the full extent is investigated, including the specific content and types of information involved. It remains unclear what information may have been compromised.

“If individuals have been involved in court proceedings or may have been mentioned in court documents, it is possible that some personal information relating to them could have been involved in the incident,” the chief justices said.

“The Ministry and the courts continue to work closely with Thomson Reuters Canada and cybersecurity specialists to assess the impact of the incident and appropriate response measures.”

Their statement says they’ve been assured that C–Track remains operational and safe to use.

A dedicated call centre and website are being established to support anyone who’s affected.

Brent Arnold, a partner at INQ Law in Toronto and chair of the Canadian Internet Society, says that while it’s too early to point fingers, the incident highlights a couple of key issues for lawyers. 

“Organizations are very dependent on their vendors, so it points to the real importance of having robust cybersecurity in those vendors, and making sure you have the protections you need for your data that you would want to put in place if you were managing it yourself,” he says, noting this is a problem every organization faces because they’re all outsourcing parts of their digital infrastructure to vendors. 

Jessyca Greenwood, vice-president of the Criminal Lawyers Association, says it’s positive that the courts have disclosed what’s happened and that Thomson Reuters is providing information to anyone who may be affected.

“It sounds like the parties aren’t sure that any confidential information was accessed, so this is a proactive disclosure. We commend the courts for taking the position that it should be disclosed, and hopefully, there can be further investigation.”

She’s satisfied with Thomson Reuters' assurances that C-Track is still safe to use, given that it is integral to how courts accept documents in electronic filing. But this underscores the need for everyone to revisit any electronic system that may have vulnerabilities.

“We need to be extra diligent in all of the different systems we use to support the functioning of the criminal justice system because our privacy and data security are so important,” Greenwood says. 

“We are dealing with very important and very sensitive information, and we want the public to have confidence in the justice system and the courts.”

This hasn’t dissuaded her from electronic filing, as nobody wants to go back to paper or have to plug the fax machine back in.

“I don’t want to be carting any bankers’ boxes to my next murder trial,” she says. “Electronic filing and an electronic case management system for the courts is here to stay.

”The Criminal Lawyers’ Association is just asking that the courts continue to investigate this issue and disclose any further information so that all proper precautions can be taken.