Thomson Reuters, through its West Publishing Corporation unit, has begun notifying individuals whose personal information was exposed after unauthorized access to a court case management software system. The breach reportedly exposed names, Social Security numbers, driver’s license numbers, dates of birth, and medical and health insurance information belonging to people connected to court proceedings that relied on the affected system.
Companies and institutions that manage sensitive personal and health-related information, including sealed or court-restricted records, have a responsibility to secure that data against unauthorized access, a responsibility that becomes even more significant when the records involve legal proceedings that individuals expect to remain confidential.
Thomson Reuters’s Data Breach Investigation
Data breach attorneys are investigating a breach affecting Thomson Reuters, a multinational information, news, and technology company headquartered in Toronto, Ontario, that provides workflow software, legal research tools, and tax compliance technology to legal and corporate professionals around the world. According to notices filed on September 2, 2026, Thomson Reuters’s West Publishing Corporation unit determined that an unauthorized party gained access to a court case management software platform in March 2026. West Publishing provides case management and docketing technology used by courts and legal professionals, meaning the breach potentially touched sensitive records tied to active or historical litigation.
The company has said that its investigation determined the unauthorized access resulted in the exposure of personal information belonging to individuals connected to matters processed through the affected software. The specific number of people affected by this incident has not yet been made public, though Thomson Reuters and West Publishing serve legal professionals across the United States, and case management software of this kind is frequently used to store both routine and highly sensitive filings, including materials that may otherwise be sealed from public view.
Breaches involving legal technology and case management platforms carry particular risk because the systems often store information that individuals reasonably expect to remain confidential, such as details from family court, criminal, or civil litigation matters. When that kind of software is compromised, the exposed data can go well beyond the basic contact information seen in many corporate breaches, extending into Social Security numbers, driver’s license numbers, and even medical and health insurance information that may have been submitted as evidence or supporting documentation in a legal proceeding.
Legal and information-technology vendors serving the court system are an increasingly common target for cybercriminals, in part because a single vendor breach can expose records belonging to many different courts, law firms, and litigants at once. Attackers who successfully breach this kind of centralized software platform can potentially access records spanning multiple jurisdictions and case types, magnifying the scope of harm well beyond what a single company’s own internal breach might cause. This is one of the reasons regulators and legal ethics authorities have increasingly focused on the cybersecurity practices of legal technology vendors, not just the law firms and courts that rely on them.
The combination of Social Security numbers, driver’s license numbers, dates of birth, and medical or health insurance information is especially valuable to identity thieves, who can use this data to open new lines of credit, file fraudulent tax returns, or attempt to obtain medical services or prescriptions using a victim’s identity. Because notification in this case came several months after the breach was reportedly discovered in March 2026, affected individuals should assume that any exposed information could already be circulating and should take protective steps immediately rather than waiting for signs of misuse to appear.
Legal observers will continue to monitor developments in this case, including whether additional details about the scope of the breach, the number of individuals affected, or the identity of the unauthorized party become public as the investigation continues.
Delayed notification, as seen here, can compound the harm to affected individuals. The longer the gap between when a breach is discovered and when victims are notified, the longer bad actors potentially have to sell, trade, or exploit stolen records before anyone knows to watch for misuse. For breaches involving legal case data specifically, this delay can be particularly troubling, since individuals may not connect suspicious financial activity or identity theft attempts back to a court filing from months earlier, especially if they were not the party who originally submitted the sensitive information to the system.
When Did This Breach Occur?
According to the notification issued by West Publishing Corporation, the unauthorized access to its court case management software occurred in March 2026. Thomson Reuters has not disclosed the specific date the intrusion began or when it was first detected internally, but the company’s investigation into the scope of the incident continued for several months before notification letters were sent to affected individuals beginning September 2, 2026. This gap between the reported breach date and the notification date is not unusual for incidents involving third-party or vendor-managed software platforms, where identifying every affected individual and determining exactly which records were accessed can take considerably longer than a breach confined to a single company’s own systems.
What Information Was Breached?
Thomson Reuters has confirmed that the breach of West Publishing’s court case management software exposed a range of sensitive personal information, including full names, Social Security numbers, driver’s license numbers, dates of birth, medical information, and health insurance information. Because the affected software is used to manage records tied to legal proceedings, some of the exposed information may have originated from documents submitted as part of litigation, rather than from a company’s own standard customer or employee database. Thomson Reuters has not indicated whether the exposed data included financial account numbers or login credentials in addition to the categories confirmed so far.
What You Can Do
If you received a notice that your information was exposed in the Thomson Reuters/West Publishing data breach, consider taking the following steps to protect yourself:
- Read your notification letter carefully and keep a copy for your records.
- Enroll in any free credit monitoring or identity protection services offered in the notice.
- Place a fraud alert or credit freeze with the three major credit bureaus.
- Regularly review your bank, credit card, and insurance statements for unfamiliar activity.
- Watch for phishing emails or calls referencing this breach or any related legal matter.
- Consider reviewing your medical insurance statements for services you did not receive.
File a Data Breach Lawsuit Against Thomson Reuters
If your personal information was exposed as a result of the Thomson Reuters/West Publishing court case management software breach, you may be entitled to compensation through a data breach class action lawsuit. Companies that manage sensitive personal and legal information have a duty to protect it, and when that duty is breached, affected individuals deserve to know their options.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
