---
title: "Arizona courts backup-data incident"
description: "Arizona courts backup-data breach: verified timeline, impact and response through October 7, 2026."
incident_type: "Data incident"
status: "active"
last_modified: "2026-10-07"
canonical_url: "https://www.ally.security/incidents/arizona-courts-backup-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/arizona-courts-backup-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/arizona-courts-backup-data-incident-2026/stix.json"
---

# Arizona courts backup-data incident

Arizona’s courts disclosed a cyberattack in which backup files were copied.

Last modified Oct 7, 2026 · 2 sources

## Summary

- **Environment:** Court backup servers
- **Operational impact:** Court reported no delays to proceedings
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Arizona’s courts](https://www.azcourts.gov/) disclosed a cyberattack in which backup files were copied. [1](#source-1)

## Impact

The FARE debt-collection dataset involved approximately 1.3 million individuals. [1](#source-1)

Copied material also included protective-order records and foster-care reports. [1](#source-1)

## Timeline

### September 24, 2026 — Attack detected and stopped

Court staff contained the attack. [1](#source-1)

### September 25, 2026 — Public disclosure

The court issued its [news release](https://www.azcourts.gov/Portals/0/201/Press%20Releases/2026/NewsReleaseArizonaCourtsExperienceCyberAttack.pdf). [2](#source-2)

### October 7, 2026 — Briefing updated

This briefing was last reviewed and updated on October 7, 2026.

## Threat Group & Attack Vector

The court said evidence suggested an employee clicked a phishing link. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Court staff stopped the attack and began notifying affected people. [2](#source-2)

The court reported no record alteration or delays to proceedings. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/arizona-courts-backup-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Cybersecurity Alert

official · Arizona Supreme Court

<https://www.azcourts.gov/cybersecurityalert>

<a id="source-2"></a>

### URGENT NOTICE: Arizona Courts Experience Cyber Attack

official · Arizona Supreme Court · Sep 25, 2026

<https://www.azcourts.gov/Portals/0/201/Press%20Releases/2026/NewsReleaseArizonaCourtsExperienceCyberAttack.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Individual Count · 100% confidence · current**  
   Arizona courts backup-data breach: 1,300,000 individual
2. **Resulted In · 100% confidence · current**  
   Arizona courts backup-data breach: The FARE debt-collection dataset involved approximately 1.3 million individuals.
3. **Resulted In · 100% confidence · current**  
   Arizona courts backup-data breach: Copied material also included protective-order records and foster-care reports.
4. **Occurred At · 100% confidence · current**  
   Arizona courts backup-data breach: 2026-09-24
5. **Exposed Data Category · 100% confidence · current**  
   Arizona courts backup-data breach: Social Security numbers
6. **Resulted In · 100% confidence · current**  
   Arizona courts backup-data breach: Arizona’s courts disclosed a cyberattack in which backup files were copied.
7. **Resulted In · 100% confidence · current**  
   Arizona courts backup-data breach: The court said evidence suggested an employee clicked a phishing link.
8. **Disclosed At · 100% confidence · current**  
   Arizona courts backup-data breach: 2026-09-25
9. **Resulted In · 100% confidence · current**  
   Arizona courts backup-data breach: Court staff stopped the attack and began notifying affected people.
10. **Resulted In · 100% confidence · current**  
   Arizona courts backup-data breach: The court reported no record alteration or delays to proceedings.
11. **Exposed Data Category · 100% confidence · current**  
   Arizona courts backup-data breach: Names
12. **Affected Organization · 100% confidence · current**  
   Arizona courts backup-data breach: Arizona Supreme Court

</details>