On September 24, a court employee clicked a phishing email link and handed attackers access to 1.3 million Arizona court records. The breach, disclosed publicly on October 7, took less than two hours from detection to shutdown. What it exposed will take much longer to absorb: Social Security numbers, case files, orders of protection, and foster care records accumulated over three decades, all of it in the hands of parties unknown.

The more significant story is not the court’s failure to stop a phishing attack. It is what the breach reveals about the data ecosystem surrounding Arizona’s legal system, and why choosing a law firm in 2026 requires asking questions that most clients have never raised.

What the Attackers Actually Took

The target was a backup server tied to Arizona’s Fines, Fees and Restitution Enforcement program, known as FARE. The program collects unpaid court debts and dates back 30 years, which is why its records contain Social Security numbers alongside names and case numbers for approximately 1.3 million people. Court technology staff detected the intrusion and shut it down roughly two hours after identifying it, but by that point the data had already been copied.

The full scope extends beyond FARE. Investigators confirmed that attackers also took roughly 30,000 active and inactive orders of protection, documents that identify individuals who have sought legal protection from a specific threat to their safety. A further 150,000 reports from a foster care review board, dating to 2010, were also compromised. The FBI was notified; Arizona’s chief justice personally briefed the FBI’s state leader on the incident. The attack does not appear to involve ransomware, no group has publicly claimed credit, and no ransom demand has been issued as of reporting. The court is urging all potentially affected individuals to freeze their credit with Equifax, Experian, and TransUnion.

The method of entry appears to have been a single phishing email. One employee, one click, 30 years of records.

Why This Is a Law Firm Problem, Not Just a Court Problem

Arizona’s courts are a passive repository for the records they are required to hold. A private law firm is a different kind of target: it actively accumulates the most sensitive information in a client’s life, often without the bureaucratic oversight that governs government systems.

The data that flows through Arizona law firms is far more concentrated than what courts hold. Personal injury attorneys carry years of medical records, wage statements, and insurance communications. Family law attorneys hold financial disclosures, custody evaluations, and sometimes domestic violence documentation. Immigration attorneys handle visa files and employment records for clients who have specific reasons to fear exposure. Business litigation attorneys hold proprietary contracts, acquisition documents, and trade secret filings. Courts hold historical records. Law firms hold live intelligence on their clients’ most consequential decisions.

The attack vector that hit Arizona’s courts is the same one that consistently targets law firms. Phishing, the method believed to have initiated this breach, is among the most common entry points in law firm data incidents. A single employee account, once compromised, typically provides access to shared drives, client portals, and the firm’s document management system. Arizona’s Rules of Professional Conduct require attorneys to make reasonable efforts to prevent the inadvertent or unauthorized disclosure of client information. A phishing-induced breach is not inadvertent in any meaningful sense; it is a foreseeable risk that professional responsibility rules expect firms to address.

The court breach makes this abstract obligation concrete. If Arizona’s court technology infrastructure, with dedicated IT staff and a legal mandate to safeguard sensitive records, can be penetrated through a single email click, then the smaller firms handling your immigration case, your divorce, or your business dispute face the same exposure with fewer resources and less visibility into where they are vulnerable.

What to Ask Before Retaining an Arizona Attorney

Data security has rarely been part of the conversation when Arizonans choose legal representation. The court breach is a reasonable occasion to change that.

Ask how the firm handles sensitive documents. Reputable practices use encrypted email, secure client portals with multi-factor authentication, and document management systems that log who accessed which files and when. “We use email” is an inadequate answer for Social Security numbers, medical records, or financial statements.

Ask who has access to your file. A smaller access list means a smaller attack surface. If your records are available to every attorney and staff member at a firm rather than your primary legal team, ask for an explanation.

Ask about the firm’s breach response plan. Every firm that handles sensitive client data should be able to describe how it would notify clients if a breach occurred, what steps it would take to contain the damage, and whether it carries cyber liability insurance. A firm that has never considered the question is providing useful information.

Ask whether the firm has undergone a third-party security assessment. Many boutique and midsize Arizona firms have not. That does not automatically mean they are insecure, but it does mean they may not have a clear picture of their vulnerabilities.

For Arizonans with any history of interaction with the state’s court system over the last 30 years, a credit freeze costs nothing and provides meaningful protection against the most likely harm from this breach. Whether or not the court notification process reaches you, taking that step removes the most exploitable window.

Arizona’s legal professionals now operate in a state where three decades of court records were extracted in a single afternoon through a phishing email. The same campaigns targeting government servers are targeting law firm inboxes every day. The question to ask your attorney is not whether they use technology. It is whether they have thought carefully about what happens when it fails.