On 24 September 2026, an intrusion at the Arizona court system began with what officials describe as a phishing email. According to The Record, federal and state investigators have now confirmed that the attackers "accessed and copied backup court files." Those files include names, Social Security numbers and case numbers for about 1.3 million people in the Fines/Fees and Restitution Enforcement (FARE) Program, with records going back roughly 30 years. The attackers also copied more than 150,000 Foster Care Review Board reports dating to 2010, including reports on about 8,000 children now in care, and protective-order records.
The strongest case for a mandate
The argument for tougher rules deserves a fair hearing. Courts hold data that citizens cannot opt out of. Nobody chooses to have a traffic fine, and a child in foster care certainly does not choose to be in a state file. Voluntary best practice has an obvious weakness when the data subject has no market power. A statutory floor, such as mandatory multi-factor authentication, retention limits and fast public disclosure, would at least make every public body meet the same standard.
That case is serious. But this incident points to a narrower problem than a missing law.
What the facts actually show
Three details stand out, all from the reporting rather than from speculation.
- The entry point was ordinary. GovTech reports that an employee opened a phishing email, and that officials described the attack as not targeted. The intrusion lasted about two hours before discovery, and the court announced it on 25 September.
- The data came from a backup server. Per GovTech, the copied data sat on a backup server holding highly compressed, encrypted information. The court says it has no evidence the data has been read, and that no court records were deleted or altered. It is too early to know whether that holds. The Record notes the format of the files may make them hard for the attackers to read, which is a hope rather than a guarantee.
- The exposure window is decades long. Records from roughly 30 years ago were still sitting in an accessible backup. A person fined in the mid-1990s was exposed in 2026 alongside someone fined last month.
None of these is a gap in statute. Phishing-resistant authentication, email filtering and offline backups are standard, free-to-publish guidance. The Cybersecurity and Infrastructure Security Agency's #StopRansomware Guide recommends phishing-resistant MFA on email and critical systems, email filtering and flagging of external messages, staff training, and encrypted offline backups that are regularly tested. This incident did not involve ransomware, according to the court's spokesperson as reported by The Record, but the same controls bear on a phishing-led theft of backups.
Why retention is the lever
The policy conclusion most consistent with the evidence is that harm scales with how much sensitive data an institution keeps, not with how clever the attacker is. A phishing email will eventually succeed against any large organisation. What differs is the blast radius afterwards.
The FARE data is a good illustration. A collections program needs Social Security numbers while a debt is live. It is much harder to argue that it needs them for 30 years for people whose debts closed long ago. Truncating or deleting identifiers once a case is resolved would turn a 1.3 million-person exposure into a much smaller one. Similarly, the Foster Care Review Board reports contain family statements and investigative findings. Those reports are sensitive enough that access should be role-limited and logged, with older material archived under stricter controls.
This is a proportionate approach: require less data, kept for less time, with fewer people able to reach it. It also costs far less than a blanket compliance regime, and it does not depend on prosecuting victims after the fact.
Disclosure and response were reasonable, and the bar is clear
The court deserves some credit. It disclosed within a day, shut the system down within hours, involved the FBI, and notified the Department of Child Safety, parents' attorneys, judges and review board members. Victims are being told by text to place credit holds. The Federal Trade Commission's Data Breach Response guide tells organisations to notify law enforcement, notify credit bureaus when Social Security numbers are stolen, and consider at least a year of free credit monitoring in such cases. A public body that holds Social Security numbers for 1.3 million people should be held to at least that standard, and Arizona residents should expect an offer of credit monitoring and a clear account of what was taken.
Two transparency questions remain open. First, how long did the stolen backups sit online before the intrusion, and why were they reachable from a phished account? Second, will the court publish a post-incident review, so that other state judiciaries can learn from it? Courts have a strong case for confidentiality about active investigations, but a public lessons-learned report once it is safe would serve every other state system.
What to do with this
Federal lawmakers will be tempted to respond with a new mandate. The better response is quieter and more targeted. State legislatures can set retention schedules for identifiers held by courts and agencies. Funding for judiciary IT can be tied to MFA and offline-backup adoption. And agencies can treat Social Security numbers as a liability to be minimised rather than an asset to be kept. A public sector that collects less will leak less, and that protects the open, innovative digital services citizens increasingly expect from government.
The Arizona breach is not evidence that the state failed to pass the right law. It is evidence that organisations keep decades of sensitive data because nothing forces them to decide when to let it go.