Russia Is Suspected to Be Behind Breach of Federal Court Filing System

Federal investigators have gathered new evidence indicating that Russia played at least a partial role in a significant cyberattack targeting the U.S. federal court system. The intrusion compromised a vast database that stores sensitive and sealed legal documents, some of which include information capable of revealing confidential sources and identifying individuals accused of national security violations.

According to sources familiar with the investigation, the breach may have been part of a long-running campaign to infiltrate the federal judiciary’s electronic systems. While investigators have not confirmed the exact entity responsible, they are examining whether a branch of Russian intelligence—or possibly other foreign actors—was behind the operation. Some of the accessed files were linked to criminal cases in New York City and other jurisdictions, with certain names suggesting ties to Russia and Eastern Europe.

The revelation surfaces just as former President Donald Trump is scheduled to meet Russian President Vladimir V. Putin in Alaska, where discussions are expected to include Trump’s proposals for ending the war in Ukraine.

Sensitive Sealed Records at Risk

An internal Justice Department memo, reviewed by The New York Times, warned federal prosecutors, court clerks, and chief judges that “persistent and sophisticated cyber threat actors have recently compromised sealed records.” The notice urged officials to remove the most sensitive files from the compromised network immediately.

“This remains an URGENT MATTER that requires immediate action,” the memo stated, referencing prior guidance from early 2021—when the system was first infiltrated—that advised extreme caution in handling classified or sealed case information.

Initially, the attack appeared to target criminal cases with international connections in at least eight federal district courts. Last month, chief judges nationwide were discreetly instructed to relocate those cases away from the main case-management platform. The guidance also directed them not to share details with other judges in their districts to prevent further exposure.

In the Eastern District of New York, Chief Judge Margo K. Brodie has since implemented strict protective measures. On Friday, she issued an order banning the upload of sealed documents to PACER, the federal courts’ public online database. Normally, PACER allows sealed files to be stored behind restricted access, but the new order requires such documents to be stored offline on a separate, secure drive.

Both the Administrative Office of the U.S. Courts, which oversees the system, and the Justice Department declined to comment publicly on the matter.

A System Long Vulnerable to Cyberattacks

The U.S. federal judiciary’s Case Management/Electronic Case Files (CM/ECF) system and PACER database are indispensable to the daily operations of the courts. But cybersecurity experts have long warned that the system contains exploitable weaknesses that could allow foreign adversaries to gain access to confidential legal information.

In the wake of the recent breach, administrators announced new protective measures to limit exposure. These steps include enhanced monitoring of sensitive files and stricter access controls. Still, officials did not publicly confirm the origin of the attack or the specific records compromised.

The breach reportedly affected federal courts in multiple states, including South Dakota, Missouri, Iowa, Minnesota, and Arkansas. An official, speaking on condition of anonymity, emphasized that sensitive documents remain attractive targets for a wide range of threat actors—from hostile nation-states to organized cybercrime groups.

Long-Standing Concerns and Prior Incidents

The hacking of the courts’ electronic filing system is not entirely new. In January 2021, the judiciary acknowledged a cyber incident but did not name Russia at the time. Former federal law enforcement officials, however, later stated that Russia was indeed responsible for that earlier breach. They described it as extremely serious, though they also acknowledged uncertainty about whether other countries exploited the system’s vulnerabilities.

Following the 2021 incident, the Justice Department introduced special precautions to protect sensitive legal documents. In some jurisdictions, prosecutors were required to hand-deliver warrants and sealed filings to the courts, avoiding electronic transmission entirely. This was particularly true in the Southern District of New York, a hub for high-profile cases involving organized crime, terrorism, and complex financial crimes.

Although these measures reduced some risk, former Justice Department officials admitted they could not eliminate vulnerabilities entirely due to the sheer scale of the court system and the complexity of its caseload.

By spring 2022, courts began implementing further cybersecurity restrictions. Judges traveling overseas were denied access to internal filing systems, and in some cases, were issued burner phones and temporary email accounts to maintain secure communications. The Administrative Office of the U.S. Courts also rolled out multifactor authentication requirements for system access.

Foreign Intelligence Links and Congressional Warnings

The cyber threat to the federal judiciary has also drawn congressional attention. In 2022, Representative Jerrold Nadler (D-N.Y.) stated that he had received information confirming that the court system’s network had been breached by three different foreign entities, with infiltration dating back to early 2020.

Matthew Olsen, then head of the Justice Department’s National Security Division, later testified that his team was collaborating with court officials to address vulnerabilities. However, he downplayed the breach’s immediate effect on active national security cases.

What This Means for U.S. National Security

The compromise of sealed federal court records raises serious national security concerns. Such files can contain details on undercover operations, intelligence-gathering methods, and confidential informants. If foreign intelligence agencies obtained this information, it could jeopardize ongoing investigations, endanger lives, and compromise U.S. law enforcement strategies.

Cybersecurity analysts note that attacks of this nature often have multiple objectives—not only stealing information but also undermining trust in public institutions. By infiltrating the judiciary’s electronic systems, foreign adversaries could sow uncertainty about the integrity of the legal process.

The breach also underscores the need for significant investment in government cybersecurity infrastructure. Federal courts handle millions of documents annually, and a growing portion of these are filed electronically. Without strong safeguards, these systems will remain prime targets for hostile nations and criminal hackers alike.

The Road Ahead

In response to the attack, court administrators are expected to continue tightening security measures, possibly shifting more sensitive proceedings offline. Cybersecurity training for judges, clerks, and attorneys will likely become a greater priority. Additionally, the federal government may push for increased funding to modernize outdated technology and improve resilience against advanced cyber threats.

As of now, investigators are still piecing together the scope and timeline of the breach. Whether the attack was solely orchestrated by Russian intelligence or involved collaboration with other foreign actors remains uncertain. What is clear is that the incident represents one of the most serious threats to the federal judiciary’s digital security in recent history.

The unfolding investigation serves as a reminder that in the digital age, even institutions built on centuries-old traditions of law and justice are not immune to the dangers of cyber warfare.