Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when the 2025 CM/ECF breach widened. The trouble was the boundary. Agencies holding dangerous records inside general systems need a tier defined by consequence, not by label.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 6, 2025, Politico reported that the federal judiciary’s electronic case management and filing system, CM/ECF, had been compromised, with concern focused on sealed filings that could identify confidential informants. The next day, the Administrative Office of the U.S. Courts cited recent escalated cyberattacks of a sophisticated and persistent nature and said it was strengthening protections for sensitive case documents. On August 12, The New York Times reported that investigators had found evidence Russia was at least partly responsible. According to the Times, the intruders searched for criminal cases in New York and several other cities, and court officials urged that sensitive documents be removed from the system quickly. Several district courts ordered that sealed documents be filed on paper or otherwise kept off CM/ECF.
Court filing systems are built for openness. Dockets and most filings are public by design. The same systems also hold sealed material whose exposure can endanger witnesses, informants and investigations. Many agencies share that pattern: a case system built for broad access that also stores a small number of records that could get someone hurt.
The judiciary had already faced this problem once. After the SolarWinds-related compromise disclosed in January 2021, it adopted special procedures for what it called highly sensitive documents, which could be filed on paper or on a secure standalone system instead of CM/ECF. The guidance at the time said many sealed filings would likely not qualify, and individual courts wrote their own definitions. A separate tier existed. The 2025 breach showed that it was drawn too narrowly, since sealed filings that later needed urgent removal were still in the main system. Getting the tier right involves three decisions: how to define what belongs in it, where it lives, and how access to it is controlled and watched. The first is the one most often gotten wrong.
Defining the tier by consequence
Most organizations classify records by legal status: public, confidential, sealed, protected by a named statute. Legal status is necessary but makes a poor boundary for architecture. A sealed trade secret and a sealed cooperation agreement share a label. The harm from exposing them differs enormously.
A better boundary asks what happens if the record is exposed. Could someone be physically harmed? Would an investigation be compromised? Would the damage be irreversible? A breach notice cannot un-expose an informant. Records that meet that test belong in the protected tier regardless of their legal label. Outside the courts, the set includes child welfare case notes, protected witness details, domestic violence survivor addresses, undercover officer identities and some public health investigation records.
A narrow, label-based definition fails in a predictable way. Filers use the general system for anything that does not clearly meet the special definition, because it is easier. The sensitive tier stays small and tidy while dangerous records accumulate outside it. The people best placed to draw the line are clerks, caseworkers and records officers, who know which documents are dangerous. A short consequence-based list, owned by them and reviewed on a schedule, keeps the boundary honest. Each addition should record why the record qualifies, so that reviewers can test the reasoning rather than inherit it.
Placing the tier
Once defined, the protected tier should not share storage, access paths and credentials with everything else. Many agencies keep it inside the general case system because one search and one workflow are convenient. That convenience means a single compromise of the general system reaches the protected records too.
Separation can take several forms. A distinct repository with its own access controls and encryption keys offers the most protection. Its keys and administrator accounts should be managed apart from the general system’s, so that one compromised administrator cannot unlock both. A segregated partition of the existing system with stronger authentication is cheaper and easier to adopt. Offline or paper handling, the courts’ emergency response, sharply reduces remote exposure for a small number of records. It costs speed, searchability and sometimes the integrity of the docket, because a paper filing must still be tracked and shared with the right parties.
The intake path matters as much as storage. If attorneys, partner agencies or contractors upload protected documents through the same portal as everything else, separation is undone at the front door. The protected tier needs its own submission route. It must be simple enough that busy filers actually use it, or they will default to the familiar portal.
Controlling and watching access
Separation reduces exposure without eliminating it. People with a legitimate need still reach the protected records. Access should be limited to named individuals with a current need, use phishing-resistant authentication, and expire when a case or assignment ends.
Monitoring is where legacy systems are weakest. Older platforms often keep thin audit logs for short periods, on the same servers an intruder controls. After an intrusion, the agency then cannot say which records were viewed, which in turn makes it impossible to decide whom to warn. For the protected tier, logs should record who opened which record and when. They should be shipped to a separate system the intruder cannot reach, and retained long enough to cover intrusions discovered months later.
Detection rules can be simple because the tier is small. Bulk access, searches by name across many cases, and access from new locations or at unusual hours are all signals worth an alert. A small, well-defined tier makes those alerts meaningful. In a general system serving thousands of users, the same rules would drown in noise.
The three decisions together produce a proportionate design. Most records stay where they are, with ordinary controls. A small, clearly defined set receives separate storage, its own intake path and close monitoring. That is achievable for most agencies sooner than securing an entire legacy platform to the highest standard. It also gives leaders a precise answer when asked which records were at risk in a breach of the main system.
With hindsight
The judiciary did not publish a full account of the intrusion’s scope, and we would not claim more than was reported. Courts continued to adopt and revise procedures for sensitive filings into 2026. The judiciary had already told Congress, in June 2025 testimony, that CM/ECF was outdated and needed replacement, and modernization remained the long-term answer.
What the episode adds to the record is the boundary problem. A special tier for the most sensitive documents had existed since 2021, and it still proved too narrow when the main system was breached. Agencies that hold dangerous records inside general-purpose case systems face the same risk. Those that define their protected tier by consequence, give it a separate intake path and keep its logs outside the main system can now say precisely what a breach of the general platform would expose. Those relying on legal labels usually cannot.