Stolen Backups, Sensitive Records: What Courts and Agencies Can Do Before Leaks Spread

In September 2026, attackers copied backup files containing personal information and sensitive case documents. The court stopped the attack, but stopping an intruder doesn't automatically prevent the copied information from leaving.

If you control records for a court or public agency, you’ve enough to worry about. People require access to services, cases must keep moving and every record is important. So where does sensitive data protection begin when a backup could end up outside your network?

The answer starts before a breach, with safeguards that follow the information itself.

The Arizona backup theft wasn't just an IT problem

On September 24, attackers accessed an Arizona court backup server after an apparent phishing attack. Staff stopped the activity within two hours.

The files included information about 1.3 million people in a court collections program, more than 150,000 foster care reports and nearly 30,000 protection orders. These aren't just database entries. They concern families, private disputes and vulnerable people.

By October 6, officials had no evidence the information was shared or misused. That's reassuring, but stronger safeguards still matter.

Getting systems running again doesn't retrieve stolen copies

Backups restore services after crashes, ransomware or accidental deletion. They can also hold years of records in one place.

But restoring your server doesn't retrieve stolen files. Changing a password might stop another login, but it won't change an unprotected document stored elsewhere.

Your plan needs both service recovery and record privacy, especially for information people never chose to make public.

Protect the records before anyone reaches the backup

You don't need to rebuild your whole security program overnight. Start with the documents that would cause the most harm if exposed.

1. Know what you're storing: Find high-risk files, remove unnecessary copies and set clear retention dates.
2. Encrypt backups properly: Keep encryption keys separate, restrict who can use them and test recovery without weakening security. The Cybersecurity and Infrastructure Security Agency (CISA) also recommends maintaining offline, encrypted backups and testing them regularly.
3. Limit each person's access: Give staff only the records they need and review permissions when duties change.

Here's a simple way to connect each risk to a practical move:

These steps make sensitive data protection part of everyday records management, not just an emergency response.

If records are copied, act on what you can control

Discovering a breach is stressful. A clear response plan helps you avoid rushed decisions.

1. Contain and confirm: Isolate affected systems, preserve logs and determine which records were copied.
2. Protect people: Notify affected groups as required, explain practical precautions and coordinate with investigators.
3. Restrict remaining access: Rotate exposed credentials, review sharing permissions and revoke access to documents that were protected in advance.

Keep one distinction in mind: you cannot remotely erase every unprotected copy. A realistic response focuses on limiting further access and helping affected people.

Make the protection travel with the document

A data-centric security platform can provide file-level control, rather than relying on the server on which it resides. Using KeyaviSafeSuite, you are able to encrypt documents, determine who will be able to open them, add time and location restrictions, view access history and modify access for future documents. Those controls stay with Keyavi-protected files even after you share or copy them.

That won't retroactively secure an ordinary backup or undo information someone viewed. Keyavi wasn't involved in the Arizona incident. The value is preparing high-risk documents before exposure, so a copied file doesn't automatically become readable.

Keeping Sensitive Data Protected Beyond the Network

You can't run a court by locking every file away. Judges need case materials. Caseworkers need reports. People need timely decisions, often during difficult moments in their lives.

You can make clever decisions on how those records are stored, shared and opened. First, determine sensitive documents. Secure backups and backup keys. Add file-level controls at every place records move from team to vendor to system.

No single tool stops every attack. However, with a combination of robust backup procedures, easy access rules and a rapid response strategy, your agency is better equipped should anything go wrong. Protection of sensitive data is all about people, not the storage device. Question yourself: if someone copied a confidential record tomorrow, could they read it?

Book a demo and see how Keyavi helps you save sensitive documents beyond your network.