Technology
ONTARIO COURTS WENT DIGITAL. SO DID THE BURGLARS.
The justice system spent years making court records easier to access. Apparently, someone took that literally.
Ontario has spent years modernizing its justice system.
Paper is inefficient. Filing cabinets are ancient. Courthouse counters are slow. Digital systems are faster, cheaper, easier to search and accessible from almost anywhere.
So Ontario began moving justice into the cloud.
There was just one tiny problem.
The cloud has doors.
And apparently somebody found one.
On September 2, the chief justices of Ontario’s three courts disclosed a cybersecurity incident involving C-Track, the Thomson Reuters case-management platform used to store and manage some Ontario court documents and records.
Thomson Reuters discovered unauthorized activity in one of its cloud environments on June 30.
Then investigators found something slightly more awkward.
The unauthorized party had obtained certain C-Track files **in March**.
In other words, by the time somebody noticed the stranger in the digital courthouse, the stranger had apparently been there months earlier.
Welcome to digital justice.
Please create an account.
The Courthouse Without Walls
C-Track is not some obscure experimental application installed on a forgotten computer in a basement.
Ontario's Court of Appeal, Superior Court of Justice and Ontario Court of Justice all use it for portions of their digital court-record management.
And Ontario has invested heavily in precisely this kind of modernization.
The Superior Court's own 2024-25 report celebrated its Courts Digital Transformation project, which began going live in Toronto in October 2025.
The price tag?
**$166 million.**
The project, procured from Thomson Reuters, was designed to replace disconnected legacy technologies with a seamless end-to-end digital justice system.
One component replaces the old FRANK case-management system with C-Track. Another integrates C-Track with the Ontario Courts Public Portal and Case Center so information and documents can move between them.
It sounds wonderful.
It is efficient.
It is integrated.
It is web-based.
It reduces workloads.
Thomson Reuters itself advertises C-Track as a way to process cases “faster and more efficiently,” giving users remote access to filings, case notes, memos, documents and court records.
And there is the modern technological miracle in one sentence.
Everything is connected.
Including, occasionally, the burglar.
What Did They Get?
At the moment, nobody publicly knows the full answer.
Thomson Reuters says its investigation determined that some affected court records contained names and personal information.
Reports concerning other affected C-Track jurisdictions indicate that the compromised material may also include confidential, redacted or sealed records. But Ontario's statement does not say that every such category was exposed in Ontario, and it would be irresponsible to pretend otherwise.
The Ontario courts say there is currently no indication that systems processing financial transactions related to court proceedings were affected.
Good.
Your credit card may be fine.
As for precisely which court information was accessed, whose information it was and what an unauthorized person may now possess?
That investigation continues.
There is something magnificently Canadian about this sequence.
Your government requires you to protect your personal information.
Your bank requires you to protect your personal information.
Your employer requires you to protect your personal information.
Every website demands that you invent another password containing an uppercase letter, lowercase letter, number, hieroglyph, extinct Mesopotamian consonant and the blood type of your first pet.
Then you hand sensitive information to the justice system because, unlike a suspicious email from Nigeria, **the court is not optional**.
And months later:
We would like to make the public aware of a cybersecurity incident.
Thank you for your patience.
The Timeline Is the Best Part
The dates deserve attention.
Unauthorized access to certain files occurred in **March**.
Thomson Reuters detected unauthorized activity on **June 30**.
Ontario's Ministry of the Attorney General was informed that Ontario court information was involved on **July 23**.
The three chief justices issued their public statement on **September 2**.
Nobody needs to invent a conspiracy around those dates. Investigating a breach, determining what was affected and coordinating notifications takes time.
But citizens are entitled to notice the absurdity.
A court will give you a filing deadline.
Miss it.
See what happens.
The digital system holding court information can have unauthorized access occur in March, detect suspicious activity at the end of June, identify Ontario data in July and tell the public in September.
Apparently some deadlines are more flexible than others.
But Don't Worry, It's Safe Now
Ontario's chief justices say Thomson Reuters took steps to contain the activity, brought in external cybersecurity experts, notified law enforcement and secured the C-Track environment.
Additional safeguards and security enhancements have been implemented.
And, importantly, the courts say Thomson Reuters has assured them that:
**C-Track remains operational and safe to use.**
Of course it does.
This is one of the great rituals of the modern data breach.
First comes:
We take your privacy extremely seriously.
Then:
An unauthorized third party may have accessed certain information.
Then:
We immediately engaged leading cybersecurity experts.
Then:
We have no evidence of further unauthorized activity.
Then:
Our systems are safe to use.
There is rarely a press release saying:
“We built a digital fortress and somebody apparently climbed through the bathroom window. Frankly, this is embarrassing.”
Corporate communications departments continue to deny civilization this pleasure.
The Vendor Problem
There is a larger issue here than Thomson Reuters.
Governments increasingly do not build all of their own critical digital infrastructure.
They buy it.
Courts buy platforms.
Hospitals buy platforms.
Police departments buy platforms.
Municipalities buy platforms.
Schools buy platforms.
The vendor promises efficiency, interoperability, scalability and security.
And often those promises are perfectly legitimate.
It would be ridiculous to demand that every provincial ministry reinvent cloud computing from scratch.
But outsourcing technology does not outsource consequences.
To the citizen, it makes absolutely no difference whether personal information disappears because a government employee made a mistake or because a private contractor's cloud environment was compromised.
The citizen did not choose the contractor.
The citizen did not negotiate the contract.
The citizen did not perform the security audit.
The citizen may not even know the contractor exists.
The citizen simply went to court.
One Platform, Many Courts
The incident demonstrates another feature of centralization.
C-Track is used far beyond Ontario.
According to Thomson Reuters' disclosure, affected court systems include **11 U.S. states, the U.S. Virgin Islands and Canada**. Reuters identifies Alabama, Pennsylvania, Kentucky, Montana, Nevada, North Dakota, South Carolina, Tennessee, Ohio, New Hampshire and Wyoming among the affected American jurisdictions.
That is the bargain of centralized technology.
One platform can serve many institutions efficiently.
One vulnerability can therefore become many institutions' problem efficiently too.
The old courthouse had filing cabinets.
A thief who wanted documents from eleven states, one American territory and a Canadian province would have needed an impressive travel budget.
Digital transformation has streamlined the workflow.
The Irony Is Almost Too Perfect
Thomson Reuters advertises C-Track's security and access controls as features that ensure sensitive case information is seen only by the right people.
That is exactly what court software should do.
Courts hold information about divorces.
Children.
Estates.
Criminal proceedings.
Businesses.
Mental health.
Family disputes.
Financial conflicts.
Victims.
Witnesses.
Defendants.
People who chose to litigate and people who desperately wished they never had to enter a courtroom.
Some court information is public by design. Open courts are an essential part of democratic justice.
Other information is confidential for equally important reasons.
A digital justice system must distinguish between the two.
That is not merely an IT feature.
It is part of justice itself.
Convenience Is Not Security
Governments love digital transformation because its advantages can be counted.
Fewer counters.
Less paper.
Less duplication.
Faster filing.
Remote access.
Lower administrative workload.
Security is harder to put in the brochure.
The safest database is one that does not exist.
The safest network is one that is not connected.
Neither is a serious option for a modern court system.
So the real question is not whether Ontario should digitize its courts.
Of course it should.
The question is whether governments have become so enchanted by convenience that they treat cybersecurity as another feature on the procurement checklist rather than as critical public infrastructure.
Because every efficiency creates a dependency.
Every integration creates another connection.
Every centralized repository creates a more valuable target.
And every cloud service eventually forces somebody to answer the uncomfortable question:
**Who else has the keys?**
The Citizen Doesn't Get to Opt Out
That is what makes government breaches fundamentally different from ordinary consumer breaches.
If you distrust a social network, don't join it.
If you dislike an online shop, buy somewhere else.
If you think an app collects too much information, delete it.
Try deleting the Ontario Superior Court of Justice.
Citizens interact with courts because lawsuits, criminal charges, divorces, estates, custody disputes and countless other legal processes require them to.
The state compels participation.
That creates a corresponding obligation.
If government requires citizens to place information into a system, “our vendor was hacked” cannot become the bureaucratic equivalent of “the dog ate my homework.”
The responsibility ultimately remains public.
Justice as a Service
Ontario's digital transformation is not inherently foolish.
Quite the opposite.
Anyone who has dealt with ancient government technology understands why modernization is necessary.
Paper bureaucracy is not some lost golden age.
But modernization has a habit of being marketed as though technology eliminates old problems rather than exchanging them for new ones.
The filing cabinet could burn.
The server can be breached from another continent.
The paper file could be misplaced.
The cloud database can expose thousands of files at once.
The courthouse clerk could make a mistake.
The contractor can make one at industrial scale.
Progress is real.
So is the blast radius.
Ontario's courts spent years making justice faster, more connected and more accessible.
They succeeded.
Apparently a little too well.
Once upon a time, if someone wanted to steal court records, he at least had to go to the courthouse.
Now he can work from home.
**Digital justice really is more convenient.**