Confirmed affected state courts as of September 10 2026
| State | Court level | Affected window | Data exposed | Public disclosure |
|---|
| Wyoming | Supreme Court and district courts | 2015 to 2025 | Names, addresses, dates of birth, case info | Wyoming News, September 2 2026 |
| New Hampshire | Supreme Court only | 2002 to 2015 | Names, case info (docket numbers, case types) | WMUR, September 2 2026 |
| Other states (TBD) | Various state supreme courts using C-Track | Under investigation | Scope under investigation | Pending state-by-state disclosure |
The pattern is informative: the Wyoming and New Hampshire windows are different, which suggests the unauthorized access is not a single discrete event but a sustained access window across the C-Track customer base. West Publishing's own investigation, in coordination with third-party cybersecurity experts, is the source for the additional state count that has not been named in the public disclosure.
What West Publishing is offering
West Publishing Corporation has provided 12 months of free credit monitoring and identity theft protection services to those potentially affected, per the Wyoming News of September 2 2026. The page CTrackNotification.com has been established to provide information about the data breach and to evaluate eligibility for credit monitoring and identity theft protection services. Eligibility can be verified through the portal regardless of which state's courts you interacted with. The free service includes credit monitoring across all three major bureaus (Equifax, Experian, TransUnion), identity theft insurance, and recovery services in the event of confirmed identity theft.
While the Wyoming Judicial Branch believes that the individuals primarily affected are those who came into contact with the district courts or Supreme Court between 2015 and 2025, individuals who have been in contact with any Wyoming district court or the Wyoming Supreme Court are invited to visit CTrackNotification.com for further information. The same eligibility process applies to other state court users potentially affected by the breach.
How this compares to other 2026 court breaches
The C-Track breach is one of several 2026 incidents involving US state court or judicial-branch data. Earlier in 2026, the Pennsylvania Court of Common Pleas reported unauthorized access to its online docket system, and several county-level court systems in California and Texas experienced ransomware attacks that exposed sealed and expunged records. The C-Track breach is distinctive in that it exposes a single vendor's data-handling across multiple state supreme courts, amplifying the scope.
The pattern is consistent with broader 2026 trends in vendor concentration risk: when a single SaaS provider is used by dozens of state and local government entities, a single breach exposes data at a much larger scale than the historical model of independent on-premises court systems, per the 2026 Brennan Center state court IT report. The SolarWinds-style supply-chain implications are significant for state governments, and the breach is likely to drive procurement-policy changes around vendor concentration in 2027, including multi-vendor mandates for case management software.
What affected court users should do
If you received a notification from CTrackNotification.com, enroll in the 12-month free credit monitoring immediately. Even if you did not receive a notification, anyone who has appeared in any US state court that uses C-Track between 2015 and 2025 should consider visiting the portal to verify eligibility. Place a fraud alert with all three credit bureaus and consider a credit freeze if identity theft is suspected. Monitor financial account statements for unauthorized activity, and treat unsolicited phone calls, emails, or text messages claiming to be from a court or West Publishing with skepticism. The breach data is a goldmine for targeted phishing campaigns and social engineering in the 12 to 24 months after the breach.
What to watch in the next 90 days
Three signals tell you whether the breach is contained or expanding. First, watch for additional state supreme court disclosures. West Publishing stated the breach impacted several other court systems but did not name them, so the next 90 days are likely to bring state-by-state confirmation, similar to the Wyoming and New Hampshire pattern. Second, watch for class-action filings. As of mid-September 2026, no class action had been filed in federal court, but the multi-state pattern and the 2015 to 2025 affected window are likely to attract plaintiffs' firms. Third, watch for procurement-policy moves by state CIOs. If two or more states issue vendor concentration mandates for case management software, the C-Track breach becomes the precedent that drives 2027 state IT procurement across the country.
Resources and next steps
- C-Track breach notification portal: CTrackNotification.com
- Wyoming Judicial Branch disclosure: wyocourts.gov
- New Hampshire Judicial Branch: courts.state.nh.us
- FTC identity theft recovery: identitytheft.gov
- Equifax, Experian, TransUnion fraud-alert and credit-freeze portals
Read next
The vendor-concentration risk pattern is covered in Cybersecurity compliance frameworks guide 2026, and the compliance-cost frame is in SOC 2 compliance cost 2026 startup guide. The insurance-side response is Cyber insurance application checklist 2026, and the detection-and-response side is Wazuh vs Splunk enterprise security 2026.
Fazlur Rahman
