Key Highlights

  • On Sept 2, Thomson Reuters disclosed that a third party obtained C-Track court files in March 2026, affecting courts in at least 12 US states, the US Virgin Islands and Canada.
  • Exposed data may include Social Security numbers, medical details and sealed court information; the company reports no evidence of misuse so far.
  • Q2 Revenue rose 9% to $1.954 billion, and full-year organic growth guidance was raised to about 8%.
  • The company agreed to sell a 51% stake in its Global Print Business to KKR-advised accounts for about $500 million and completed a $605 million return of Capital and a $600 million buyback.

Thomson Reuters Corporation (NASDAQ:TRI) is dealing with a reputational test in one of its most sensitive customer groups. On Wednesday, September 2, the information services company publicly disclosed that an unauthorized party had obtained files from C-Track, a court case management platform run by one of its subsidiaries, exposing court records and personal data from courts in at least 12 US states, the US Virgin Islands and Canada.

The financial consequences are not yet clear. Thomson Reuters has not quantified any cost, and the affected product is a small part of a company that generated $1.95 billion in second-quarter revenue. The bigger questions for investors concern trust and governance at a time when the company is positioning itself as a provider of what it calls "Fiduciary-Grade AI" for lawyers, accountants and government customers.

In short, the breach is a manageable financial event so far but a meaningful reputational one, and further disclosures from courts, regulators or litigants could change that assessment.

What Happened Inside C-Track

According to the company's notice, Thomson Reuters discovered unauthorized activity on June 30, 2026, and began an investigation with outside Cybersecurity experts and law enforcement. It determined that in March 2026 a third party obtained certain C-Track files. Montana's Supreme Court separately said the company told officials the access ran from March through June.

The records may have included names alongside Social Security numbers, driver's license numbers, medical information, dates of birth and Health Insurance details. The company also said confidential, redacted or sealed court information may have been affected at some courts.

Affected systems named in the US notice include appellate courts in Alabama, Kentucky, Montana, Nevada, New Hampshire, North Dakota, South Carolina, Tennessee and Wyoming, several Pennsylvania courts, 10 Ohio district courts of appeals and courts in the US Virgin Islands. Oregon's judicial department said its appellate courts were also involved. In Canada, three Ontario courts were affected.

Thomson Reuters said the incident took place within its own environment, not the courts' systems, that C-Track remains fully operational, and that it has added security measures reviewed by outside experts. It said it had no evidence to date of Fraud or misuse and is offering affected individuals 12 months of free Credit monitoring. The company has not disclosed who was responsible, how access was gained or how much data was taken.

Why the Timeline Matters

The gap between intrusion, discovery and disclosure is likely to draw scrutiny. Thomson Reuters notified Montana's court administrator and Ontario's Ministry of the Attorney General on July 23, more than three weeks after discovery, and the public disclosure came in September. Ontario's chief justices said it remained unclear exactly what information was compromised or how many people were affected.

For a company whose products are embedded in courts and government agencies, questions about detection speed and communication could shape future procurement decisions, even if C-Track itself is a niche product.

Thomson Reuters has not broken out C-Track's revenue, and the company's reported segments are Legal Professionals, Corporates, Tax, Audit & Accounting Professionals, Reuters News and Global Print. Government customers are served within those units, which means any reputational spillover would most likely show up in renewal rates and new bookings rather than as a discrete line item.

A Strong Operating Backdrop

The breach arrives against solid results. On August 5, Thomson Reuters reported second-quarter revenue of $1.954 billion, up 9%, with organic revenue up 8%. Its "Big 3" segments, Legal Professionals, Corporates and Tax, Audit & Accounting Professionals, grew 10% organically and made up 83% of revenue.

Operating profit rose 28% to $558 million. Diluted EPS increased to $1.02 from $0.69, and adjusted EPS rose to $0.99 from $0.87. Adjusted EBITDA grew 10% to $745 million, lifting the Margin to 38.1% from 37.8%, and free Cash Flow reached $727 million.

Management raised its 2026 total and organic revenue growth outlook to approximately 8.0%, and to 9.5% to 10.0% for the Big 3. For the third quarter, it guided to organic growth of about 8% and an adjusted EBITDA margin of about 36%.

The company also agreed to form a joint venture with KKR (NYSE:KKR) for its Global Print business, selling a 51% stake to KKR-advised accounts for about $500 million in gross proceeds on closing. It completed a $605 million return of capital in May and a $600 million share buyback. CEO Steve Hasker said the priority for the second half is "deepening our Leadership in trusted Fiduciary-Grade AI solutions," pointing to CoCounsel Legal and the company's Thomson LLM.

Competitive Stakes in Legal Tech

Thomson Reuters competes with RELX (NYSE:RELX)'s LexisNexis, Wolters Kluwer and a wave of AI-native legal startups. Its pitch rests on trusted content and secure handling of confidential data. A breach involving sealed court files, even in a separate platform, gives rivals a talking point, while customers may ask tougher security questions during renewals of research and workflow tools.

Risks to Monitor

  • Scope creep: The list of affected courts has grown as individual courts issue their own notices, and the full extent may not yet be known.
  • Legal and regulatory exposure: Breaches involving Social Security numbers and health data often attract class actions and regulatory inquiries, though none had been confirmed as of this writing.
  • Customer trust: Government and legal clients may reassess vendors, affecting sales cycles.
  • Offsetting strengths: High recurring revenue, raised guidance and strong cash generation give the company capacity to absorb remediation costs.

Gauging the Fallout in Thomson Reuters' Next Report

Investors will look for any cost estimate or further detail on the breach in Thomson Reuters' third-quarter report, which the company has typically released in early November; a specific date has not yet been confirmed. Other markers include additional court or regulator disclosures, any litigation, the closing of the KKR Global Print transaction and whether third-quarter organic growth meets the roughly 8% guidance.

Commentary on AI product adoption, particularly CoCounsel, is also likely to shape sentiment.