A vendor cybersecurity incident involving Ohio's appellate-court case-management system reportedly gave hackers access to between 3.5 million and 4 million documents, according to figures Chief Justice Sharon Kennedy cited in her annual State of the Judiciary address. The Supreme Court of Ohio has said the extent of any personal-information exposure remains under investigation. Kennedy used the breach as part of a broader warning that artificial intelligence could create new risks for judicial independence, and said the same intrusion affected 18 supreme courts across the country.
A Breach That Reached Deep Into Ohio's Courts
According to WKBN, Kennedy said the Supreme Court was notified about the cybersecurity breach on July 24, 2026, and that 10 of Ohio's 12 appellate districts were affected. That timeline lines up with the Supreme Court of Ohio's own account: the court disclosed on September 2, 2026, that vendor West Publishing and Thomson Reuters notified it on July 24 of a cybersecurity incident involving the C-Track case management platform, an intrusion that reportedly originated in March 2026, according to the Supreme Court of Ohio. The court confirmed that Cuyahoga County's 8th District and Franklin County's 10th District were spared because neither uses the C-Track platform.
The C-Track intrusion raised concerns about the possible exposure of court filings and personal information. Thomson Reuters has said the intrusion originated in its cloud infrastructure rather than in court-managed internal networks, the outlet reported. In response, West Publishing began offering 12 months of free credit monitoring and identity restoration through Experian IdentityWorks to people whose data may have been exposed, along with a dedicated toll-free call center, Help Net Security reported.
Kennedy Urges Judges to Think Hard About AI's Unsettled Terrain
Beyond the breach, Kennedy told judicial conference members they need to grapple seriously with what she called the unsettled world of artificial intelligence, per WKBN's account of the address. She said she is concerned that sensitive personal data passing through the court system could end up feeding an AI model, and she raised broader legal questions AI is bound to trigger — including whether AI-generated memes or creations are legally protected, and whether using someone's likeness in an AI creation could violate that person's rights. Kennedy posed that latter question about her own image, according to the outlet.
Kennedy said she is part of a national consortium of judges studying how AI should — and should not — be used inside the court system. She was firm on one point: AI will not replace the analytical or outcome-determination functions of a case, WKBN reported. That distinction underscores the importance of human judgment in the courts.
Real Sanctions Already Hitting Ohio Lawyers
The consequences of inaccurate AI-assisted filings are also documented in Ohio court records. In State v. Coleman, 2026-Ohio-965, the Eleventh District Court of Appeals required the respondent to attach a signed certification to every filing submitted to any Ohio court for two years, according to the court's judgment entry.
Ohio's Board of Professional Conduct had already moved to get ahead of that problem. On June 2, 2026, the board published the Ohio Ethics Guide: Artificial Intelligence for Lawyers and Judicial Officers, formally defining AI as a relevant technology under Rule 1.1 of the Rules of Professional Conduct and requiring independent human review of all AI legal outputs to prevent factual or legal hallucinations in filings, according to Benesch Law. The guidance requires lawyers to maintain technological competence and safeguard client confidences when using such tools.
What Ohio's Guidance and Records Show
Ohio's official guidance emphasizes caution rather than automatic acceptance of generative AI. Attorneys and judicial officers should understand both the technology's potential benefits and its unintended consequences, according to the Supreme Court of Ohio's AI Resource Library. The enforcement record includes State v. Coleman, 2026-Ohio-965, in which the Eleventh District required signed accuracy certifications on every filing submitted to an Ohio court for two years, according to the court's judgment entry. The public materials cited here establish Ohio's general notification framework, but do not by themselves describe specific vendor-security controls used for C-Track. Ohio Revised Code Section 1349.19 generally requires entities that own or license computerized data containing personal information to notify affected Ohio residents of qualifying breaches, generally within 45 days of discovery or notification. A 2025 Arizona Judicial Conference briefing described a different kind of disruption: After a 2021 breach, the Alaska Court System disconnected its online servers and reverted to manual operations for several days.
Judges Weigh In on Navigating the Technology
Paul Pfeifer, executive director of the Ohio Judicial Conference and a former Ohio Supreme Court justice, advised judges to approach rapidly changing technology carefully, according to WKBN's report. He said the technology would not alter a judge's core role and pointed to the July breach as a reason for caution.
Kennedy's address also touched on judges needing to consider how to interpret the law and constitution while respecting separation of powers as AI reshapes the legal landscape, and she addressed the 250th anniversary of the American Revolution as part of her broader remarks on judicial independence. Separately, incoming OSBA President Jan Allen Baughman formally took over leadership of the statewide organization for the 2026–2027 term at the Ohio State Bar Association's annual gathering on July 1, 2026, according to the Ohio State Bar Association.
A National Reckoning Over AI in the Courts
Ohio's concerns mirror a broader national reckoning. As of April 2026, some federal and state judges had instituted standing orders requiring explicit disclosure when AI is used in court submissions, while the U.S. Judicial Conference proposed Federal Rule of Evidence 707 to require reliability hearings for AI-generated evidence lacking a human expert witness, according to the American Bar Association. Separately, the Judicial Conference of the United States announced on September 17, 2026 that it is fast-tracking a full redesign of its federal Case Management/Electronic Case Files system, aiming to replace legacy software with a modernized, cyber-secured platform by 2027 in response to persistent cybersecurity threats, per United States Courts. Federal district courts will migrate to the new system first, ahead of appellate and bankruptcy courts.
Ohio lawmakers have also been moving on adjacent digital-identity concerns. State legislators introduced Senate Bill 163 to establish criminal penalties, civil remedies, and digital watermark regulations targeting non-consensual AI deepfakes, synthetic identity fraud, and unauthorized digital likeness misuse, according to the Koffel Law Firm. Between the C-Track breach, the sanctions against attorneys who relied on AI-hallucinated filings, and the legislative push around synthetic media, Kennedy's message landed at a moment when Ohio's courts are confronting the technology's risks on multiple fronts at once.
