Arizona Supreme Court Says Hackers Stole Residents' Data

Executive Summary

The Arizona Supreme Court disclosed Friday that intruders copied personally identifiable information belonging to "many Arizonans" from the state's court system, according to a statement from Chief Justice Ann Scott Timmer. A court spokesperson told Recorded Future News the incident did not involve ransomware and that no ransom demand had been received as of Monday. No hacking group has publicly claimed responsibility, and the FBI is leading the investigation.

The disclosure is notable less for what it confirms than for what it does not: there is no named threat actor, no stated victim count, no ransom note, and no technical detail about how the intruders gained access. Court officials say they are withholding specifics because releasing them could compromise the ongoing investigation.

Technical Analysis

Timmer's statement, issued Friday, described the intrusion as the work of "criminal hackers or their bots" and said court leaders believe the attackers copied personally identifiable information about a large but unspecified number of Arizona residents. The Administrative Office of the Courts is in the process of notifying affected individuals, Timmer said.

The court has not disclosed the intrusion vector, the dwell time, the systems accessed, or the categories of PII involved. Timmer said the court would not release further details because doing so "may impact the investigation into the attack." She added that she personally spoke with the top-ranking FBI official in Arizona and pledged the court's cooperation.

The absence of a ransomware component distinguishes this incident from the majority of recent U.S. court-system compromises. Kansas' court system was shut down by ransomware in 2023 and took months to fully restore. State and municipal courts in California, Nebraska, South Carolina, Florida, Wisconsin, Louisiana, Ohio, Missouri, and Illinois have faced ransomware, DDoS, or data-theft incidents over the past four years. In November, ransomware attackers breached the Pennsylvania Office of the Attorney General, disrupting the state's court system for nearly a month and forcing time extensions in criminal and civil cases. The organization managing real estate and civil court filings in Georgia was also hit with ransomware in November.

That pattern — ransomware crews targeting judicial infrastructure for both extortion and operational disruption — makes the Arizona case's apparent lack of an extortion demand unusual, though not unprecedented. Data-theft-only intrusions against government systems are frequently attributed to espionage-motivated actors or to crews that exfiltrate data and attempt to sell it on criminal markets rather than negotiate directly with the victim. Arizona officials have not indicated which, if either, scenario applies here.

Mitigations & Recommendations

Because the court has not published an intrusion vector, indicators of compromise, or affected system details, defenders outside Arizona's judiciary have limited actionable intelligence from this disclosure. The practical takeaways are procedural:

• Arizona residents who have interacted with state court services — filings, jury summonses, case participation, or employment — should treat any unsolicited communication referencing court business with heightened suspicion, particularly messages requesting PII confirmation or payment. The court said it is contacting affected individuals directly; recipients should verify any such notice through the Administrative Office of the Courts rather than through links or phone numbers in the message itself.
• For judicial and government IT teams, the Arizona case reinforces that data-theft intrusions without a ransomware payload can go undetected longer than encrypted-environment incidents, because there is no disruptive event to force discovery. Monitoring for anomalous bulk reads of case-management and PII stores, and for outbound transfers from systems that should not generate them, remains the primary detection surface when no encryption event occurs.
• Organizations holding comparable PII troves should confirm that access logging on case-management, filing, and HR systems is retained long enough to support a retroactive investigation, since the Arizona disclosure suggests the intrusion was identified before any public claim of responsibility.