Advisories
Arizona Court System Breach Exposes Foster‑Care Records and Protective‑Order Backups
A phishing attack compromised Arizona court backups, exposing more than 150,000 foster‑care recommendation reports and protective‑order files. The breach raises serious privacy and safety risks for affected families. Defenders should audit backup security, enforce email‑filtering, and monitor for leaked data.
Arizona’s court system was hit by a phishing‑driven breach that exposed more than 150,000 foster‑care recommendation reports and protective‑order backup files.
What happened
A court employee opened a malicious link in a spear‑phishing email. Attackers accessed compressed backup archives that contained sensitive case data, including foster‑care reports dating back to 2010 and protective‑order records.
Impact
- Over 150,000 foster‑care reports, containing child names, case details, and board findings, were copied.
- Protective‑order backups that could reveal identities of victims of abuse or harassment were also exfiltrated.
- No evidence yet of juror, witness, or employee data, but the scope of the breach could create safety risks for affected families.
What to do
Defenders should:
- Verify if they are listed in the court’s public breach notification and review the specific documents that were exposed.
- Implement stricter email‑filtering and user‑training to block phishing links.
- Audit backup storage for proper encryption and access controls, and enforce least‑privilege access.
- Monitor the dark web and data‑leak databases for any of the exposed files.
- Notify affected individuals promptly and provide guidance on protective measures.
Arizona is working with the FBI; no ransomware group has claimed responsibility.
Related articles
Frontline Education breach exposes school district employee data via third-party software flaw
Frontline Education told school districts that attackers used a vulnerability in a third-party application to access part of its environment and steal employee records, including Social Security numbers. The company identified the issue on August 14, 2026, remediated it, and engaged law enforcement, but has not named the affected product or the initial access date. Districts should treat the incident as a potential PII exposure and begin credential, identity, and monitoring follow-up.
Read briefing
DMDC File‑Sharing Server Breach Exposes 3 Million DoD Personnel Records
The Defense Manpower Data Center (DMDC) confirmed that a security flaw in its file‑sharing system allowed unauthorized users to read unencrypted personal data for roughly nine months. The breach, discovered in mid‑July 2026, exposed PII for about 3 million Department of Defense personnel. Defenders should verify DMDC system patches, monitor for suspicious activity, and review access controls on file‑sharing services.
Read briefing
Astrana Health Discloses Data Breach Stemming from Employee Social Engineering
Astrana Health reported a data breach impacting private and confidential records after attackers used targeted social engineering, including phone number spoofing, to impersonate internal personnel and access company servers. The healthcare management firm has enacted credential rotations, restricted remote access tools, and initiated system restorations from clean backups.
Read briefing
Florida DMV Driver Database Breach: Stolen Police Credentials Reveal Over 200k Records
The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after the ShinyHunters extortion gang claimed to have accessed the system using stolen police credentials. The attackers exploited a compromised account belonging to a Plant City Police Department employee, who stored the login on a personal device. While ShinyHunters alleged a password‑reset flaw and claimed more than 200,000 records were exfiltrated, FLHSMV has not confirmed the exact number of records accessed. The agency has notified state authorities, halted further intrusion, and i
Read briefing