Nevada Courts Data Breach: Las Vegas Business Risk

What Happened: A Breach Nevada’s Courts Didn’t Cause

In September 2026, Nevada’s Administrative Office of the Courts confirmed a data security incident tied to a vendor, not to its own network. West Publishing Corporation, the Thomson Reuters subsidiary behind the widely used C-Track case management system, notified Nevada that an unauthorized party had accessed files inside West Publishing’s own IT environment.

The exposure wasn’t limited to Nevada. Appellate courts in Alabama, Kentucky, Montana, North Dakota, South Carolina, Tennessee, New Hampshire, Wyoming, and the U.S. Virgin Islands were affected, along with multiple Ohio and Pennsylvania courts. West Publishing has said the intrusion actually began in March 2026 — meaning the unauthorized party sat inside the vendor’s systems for roughly six months before any of the affected courts, or the public, knew about it.

The data at risk is not minor: names, Social Security numbers, driver’s license numbers, dates of birth, medical information, and health insurance details tied to court records. West Publishing has been explicit that the incident was not caused by any court’s own network, systems, or security practices — it happened entirely on the vendor side.

How a Vendor Breach Becomes Your Breach

Most Las Vegas business owners read a headline like this and assume it’s a government IT problem, not theirs. It isn’t. The mechanics of this breach are identical to the ones that hit private-sector vendors serving small and mid-sized businesses every day — payroll processors, case management tools, cloud backup providers, scheduling software. Here’s what actually happened, technically:

• Shared attack surface: One vendor’s software runs inside dozens of unrelated organizations. Breach the vendor once, and every organization using that software is simultaneously exposed — regardless of how strong their own network security is.
• Delayed detection: The intrusion happened in March 2026 but wasn’t disclosed until September. A six-month dwell time gives an attacker ample opportunity to quietly copy, sell, or stage data for later use.
• Cascading notification: Ten states and jurisdictions had to issue separate public notices from a single upstream compromise — a sign of how many organizations can be downstream of one vendor’s mistake.
• Sensitive data at rest: SSNs, driver’s license numbers, medical records, and health insurance data sitting inside a case management system is exactly the kind of information attackers monetize fastest on dark web marketplaces.

What’s at stake for Las Vegas businesses in a scenario like this:

• ⚠ Law firms and businesses whose case files or filings run through affected court systems may have client data exposed without any breach of their own network.
• ⚠ Any SMB relying on a shared SaaS or case-management vendor — without ever vetting that vendor’s security posture — carries the same hidden exposure.
• ⚠ Employees or clients whose SSN, driver’s license, or medical data sat in exposed files face a real, long-tail identity theft risk that outlasts the news cycle by years.
• ⚠ Under Nevada’s breach notification law, businesses that can’t show they assessed vendor risk face compliance exposure on top of reputational damage.

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas works with local law firms, professional services firms, healthcare practices, and government contractors every day to answer the exact question this breach raises: what happens to your business when a vendor you trust gets hit? We help Clark County businesses inventory vendor risk, harden contracts, and build incident response plans that account for breaches that start outside your own walls — because increasingly, that’s where they start.