Arizona Courts System

An employee of Arizona's courts system clicked a malicious link. The resulting access exposed data on about 1.3 million people who have unpaid fees, fines or restitution, with records going back roughly thirty years.

Public reporting at the time of writing establishes the vector, the scale and the population. It does not establish the dwell time, the specific systems reached, or a field-level breakdown, and those gaps are marked here rather than filled.

Records of people owing money to the courts: names and the debt itself, across three decades of cases. The specific fields have not been enumerated publicly.

What makes a court debt record sensitive is not the field list. It is the inference. A person appearing on this list had a case, and the case produced a financial obligation they have not discharged. That is a status the record reveals regardless of which columns were copied.

People with outstanding court debt, which skews heavily toward those least able to pay. A thirty-year window means the list includes people whose cases closed before the current staff were hired, and who have had no contact with the courts in decades.

The harm is specific to the context. Debt collection fraud works because the underlying debt is real, and a caller who can cite a genuine court obligation from 2004 is credible. The same list also exposes a matter many people have reasonably considered closed.

Phishing resistance training and link filtering are standard, and a judicial system holding historical case records is doing what the law requires. Courts are obliged to retain records of judgments and obligations, often for decades.

Retention mandate and accessibility are separate questions, though. A requirement to keep a thirty-year-old record does not require that record to be reachable from a mailbox that an employee uses for everyday correspondence.

How far back the reachable data went. One click produced thirty years of records, which means the active working environment had a path to the full historical set.

That is the pattern worth naming. Organizations archive for compliance and then leave the archive mounted for convenience, so a credential that should expose this quarter's work exposes every quarter since 1996. Nobody decides this. It accumulates.

A court that knew which systems held which decades, and what each account could reach across them, would have scoped this incident in hours. The thirty-year figure suggests nobody had drawn that map.

No group has been named and no extortion demand is in the public record. A phishing click followed by data access, without a ransomware payload, is consistent with theft for resale.

Government debt records have a direct criminal market in collection fraud, so the absence of extortion does not imply the data is idle.

Separating the archive from the working environment. Thirty years of records needed to exist. They did not need to be reachable from the account of an employee reading email.

Second, knowing the age and contents of what each system holds. The difference between a breach of current cases and a breach spanning three decades is an access boundary, and that boundary can only be drawn by somebody who has looked at what is on each side of it.