Kentucky courts filing system part of ‘cybersecurity incident,’ judicial branch officials say

Ohio Capital Journal · McKenna Horsley · September 3, 2026

The Administrative Office of the Courts office in Frankfort, Kentucky, on March 26, 2026. (Kentucky Lantern photo by Sarah Ladd) The Kentucky Administrative Office of the Courts said the system used for files for the Kentucky Supreme Court and Court of Appeals “experienced a cybersecurity incident.”

AOC said it was notified by the company Thomson Reuters Court Management Solutions about the incident within the company’s C-Track system files. The company said an unauthorized third party accessed and obtained court data from multiple states, including Kentucky Appellate Court data.

A company notice about C-Track said the unauthorized activity was discovered on June 30 and data had been accessed in March from courts in Kentucky, Alabama, Pennsylvania, Montana, Nevada, North Dakota, South Carolina, Tennessee, New Hampshire, Ohio, Wyoming and the U.S. Virgin Islands. Some records may contain individuals’ names and personal information like Social Security number, driver’s license number, medical information, date of birth and health insurance information, the notice said.

As of Wednesday, the number of individuals and organizations affected is not known, the AOC statement said.

“Kentucky Appellate Courts were not functionally impaired by this incident,” the AOC statement said. “The AOC has no indication at this point that the unauthorized third party distributed the Kentucky data to any other party or entity. Thomson Reuters CMS is working with third-party experts and law enforcement and has assured each affected jurisdiction that it has taken significant mitigation steps to prevent unauthorized access to the data in the future.”

As Kentucky does not use third-party vendors for trial court e-filing, trial information not in an appeals case is not affected by this, AOC said. Any person determined to be affected by the incident will be notified by Thomson Reuters CMS with further information and a year of credit monitoring and identity theft protection.

Thomson Reuters CMS is leading the investigation and AOC is cooperating with it to identify Kentucky data involved.

This story has been updated with additional information.

This story was originally produced by Kentucky Lantern , which is part of States Newsroom, a nonprofit news network which includes Ohio Capital Journal, and is supported by grants and a coalition of donors as a 501c(3) public charity.

Read the full story at Ohio Capital Journal