A cyberattack on Arizona's court system that exposed sensitive data on about 1.3 million people is shaping up to be a test of how a state self-insures cyber risk.
Court officials said in an updated notice that criminal hackers accessed and copied backup court files after an employee clicked a malicious link in a phishing email. The largest data set came from the courts' Fines/Fees and Restitution Enforcement (FARE) program. It held names, Social Security numbers and case numbers for about 1.3 million people with court debts going back 30 years.
The attackers also copied more than 150,000 Foster Care Review Board reports dating back to 2010, along with records on active and inactive protective orders. The court said the attack started on September 24 and was shut down less than two hours after it was identified. It said there was no evidence the data had been shared, and that it was unclear whether most of the compressed backup files could easily be read.
Arizona does not buy cyber cover for each of its agencies in the way a private company might. State law establishes a cyber risk insurance fund within the Department of Administration (ADOA), alongside its general risk management fund. The funds are used to buy insurance, pay self-insured losses and provide loss prevention services.
ADOA's risk management section buys excess and catastrophe insurance on top of that funded self-insurance. Legislation passed in 2022 added data breaches and security incidents to the events covered by the state's self-insurance. It also required ADOA to buy breach insurance for selected agencies and allowed it to impose deductibles on agencies for cyber losses.
Under the state's rules, the ADOA director decides which agencies receive cyber breach coverage and can limit coverage to selected bodies. Whether the judicial branch's FARE and foster care systems fall within that coverage, and at what deductible, has not been disclosed.
This breach brings together several of the most expensive elements of a cyber loss. Notification and credit monitoring for 1.3 million people would be costly on their own. The court has already started notifying people by text and has urged them to freeze their credit.
Third-party exposure may prove larger. The data on Social Security numbers and court debts creates a risk of identity theft. The foster care reports, which contain statements from families and investigative findings about children, and the protective order records, involve some of the most sensitive information a public body holds. Claims or regulatory action over that data would fall to the state's self-insurance first, with excess insurers responding only once losses pass the retained layer.
A court spokesperson has said ransomware was not involved and no ransom has been demanded, which removes one element of potential cost.
For brokers working with public entities, the Arizona case is a clear example of how cyber risk sits differently in the public sector. Many states, counties and municipalities retain large amounts of cyber risk through self-insurance funds or pools, and buy commercial cover only as excess. That puts the risk of a large breach on taxpayers and makes the attachment point of the excess layer central to the placement.
The attack also shows what underwriters will focus on at renewal. A single phishing click got past mandatory annual training and round-the-clock monitoring, and reached backups holding decades of legacy data.
Public entity buyers, whether they buy cyber directly or through a state fund or pool, can expect closer scrutiny of data retention policies, backup segmentation and encryption, and phishing-resistant authentication. Brokers who help clients address those points before renewal will be in a better position on attachment points and terms.
