U.S. investigators have found indications that Russia played at least a partial role in a recent cyberattack on the federal court system’s electronic filing network, which contains highly sensitive information — including materials that could potentially expose confidential sources and individuals charged in national security matters, according to multiple people familiar with the situation.
It remains uncertain which specific group carried out the breach or whether it was directly tied to Russian intelligence. Officials have also not ruled out the involvement of other nations. Sources familiar with the probe said the hack appears to have been part of a multiyear campaign to penetrate the system. Searches conducted by the intruders touched on various criminal cases in New York City and other jurisdictions, including some involving defendants with Russian and Eastern European last names.
News of the infiltration comes just as President Trump is preparing to meet Russian President Vladimir V. Putin in Alaska on Friday, with the conflict in Ukraine expected to be a central topic of discussion.
Court administrators recently sent an internal memo to Justice Department officials, court clerks, and chief judges across the federal system warning that “persistent and sophisticated cyber threat actors have recently compromised sealed records.” The memo, reviewed by The New York Times, urged recipients to quickly move the most sensitive files off the vulnerable network.
“This remains an URGENT MATTER that requires immediate action,” the notice emphasized, echoing guidance the Justice Department first issued in early 2021 when the system was initially breached.
Early assessments suggested that criminal cases with foreign connections in at least eight federal districts were affected. Last month, chief judges nationwide were quietly told to remove such cases from the main system. According to people briefed on the matter, those judges were also instructed not to share details with other judges in their districts at the time.
In the Eastern District of New York, judges have begun implementing new safeguards. On Friday, Chief Judge Margo K. Brodie issued an order banning the uploading of sealed documents to PACER, the public database used for court filings and dockets. While sealed records were typically stored there with restricted access, they will now be placed on a separate, offline drive to reduce exposure.
Peter Kaplan, spokesperson for the Administrative Office of the U.S. Courts, which oversees the network, declined to provide comment. The Justice Department also did not immediately respond to a request for comment.
Federal authorities are now racing to trace the hackers’ activity, measure the extent of the breach, and strengthen the defenses of a massive and widely used system that has long been viewed as a tempting target for hostile governments.
Last week, the Administrative Office of the U.S. Courts announced publicly that it was taking additional steps to secure the network, including the Case Management/Electronic Case Files platform used for uploading filings, along with PACER. Officials did not reveal the origin of the intrusion or specify which files were accessed. According to one source, courts in South Dakota, Missouri, Iowa, Minnesota, and Arkansas were among those compromised.
“Sensitive documents can be targets of interest to a range of threat actors,” last week’s public statement warned. “To better protect them, courts have been implementing more rigorous procedures to restrict access to sensitive documents under carefully controlled and monitored circumstances.”
Politico previously reported that an unidentified foreign group had been attacking the system since early July.
Security concerns about the courts’ digital filing platform go back well before this summer. In January 2021, officials disclosed a cyber intrusion but did not attribute it to Russia.
Former federal law enforcement officials have said Russia was indeed responsible for that earlier breach. They acknowledged uncertainty about whether other nations exploited the same weaknesses, but described the 2021 attack as exceptionally severe.
Following the 2021 revelation, investigators were instructed to adopt strict precautions, including physically delivering certain sensitive documents to the courts instead of filing them electronically. In some districts — notably the Southern District of New York — prosecutors were urged to submit important complaints and indictments on paper.
While these measures improved security somewhat, former Justice Department officials said the sheer scale of the filing system and the complexity of cases made it impossible to eliminate all risks.
By spring of last year, the courts had already begun further tightening security, according to two officials. Judges traveling abroad were blocked from accessing internal filing systems and were sometimes provided burner phones and new email accounts to communicate with staff. In May, the Administrative Office announced it would require multifactor authentication for system access.
In 2022, Representative Jerrold Nadler, a New York Democrat, said he had received information that three unidentified foreign actors had breached the court network as far back as early 2020.
Matthew Olsen, then head of the Justice Department’s national security division, later testified that his office was working with court officials to address these cybersecurity issues. He played down the impact on cases his division was pursuing, but acknowledged the ongoing need for stronger protections.
{Matzav.com}
