A cyberattack on Arizona's court system exposed sensitive information connected to more than 1.3 million people after an employee clicked a malicious link in a phishing email, according to state court officials. The intrusion also compromised protective-order records and more than 150,000 confidential foster-care reports.

The attack began on September 24 and reached a backup server used by the Arizona Judicial Branch. Court technology staff detected the intrusion and shut it down approximately two hours later. The Arizona Supreme Court subsequently contacted the FBI and began notifying people whose information may have been copied.

The largest affected dataset came from Arizona's Fines/Fees and Restitution Enforcement program, known as FARE. Approximately 1.3 million people with unpaid court fees, fines or restitution obligations dating back as far as 30 years were included in the copied data. Records contained information including names, case numbers and Social Security numbers.

Arizona has since established an online verification system allowing people referred to the FARE program to check whether their information was affected. The system requires a person's last name and the final four digits of their Social Security number to determine whether their records were among those accessed.

The attackers also obtained nearly 30,000 active and inactive orders of protection, according to the Arizona Supreme Court. Those records are particularly sensitive because protective orders can involve victims seeking protection from domestic violence, harassment or other threats. Local reporting has documented cases in which affected records included names and residential information connected to victims and their family members.

More than 150,000 Foster Care Review Board recommendation reports dating to 2010 were also copied. The board reviews cases involving children in out-of-home placements and provides recommendations to juvenile courts concerning their safety, well-being and progress toward permanent placement. Those reports can contain information concerning children, parents, dependency proceedings and recommendations made to judges and child-welfare officials.

Court officials say they have identified at least 99% of the information downloaded during the intrusion. Arizona Supreme Court Chief Justice Ann Timmer has said officials are operating under the assumption that attackers may be capable of matching names contained in the stolen data with Social Security numbers.

The breach did not result in court records being altered or deleted, and officials say information concerning jurors, witnesses and court employees was not stolen. Court operations and scheduled cases have also continued without disruption.

Arizona Supreme Court spokesperson Alberto Rodriguez said Tuesday that officials currently have no evidence the copied information has been used or publicly shared. The investigation remains active as the Judicial Branch and federal authorities work to determine who carried out the attack and the full extent of the data accessed.