The Backup Was the Target
On September 24, 2026, IT staff at Arizona's court system noticed something wrong and shut the network down. By the time investigators finished their review, the number was 1.3 million people. Their names, Social Security numbers, and case numbers had been sitting in files that dated back three decades.
The attackers didn't need to break into a live case management application. Court officials said the hackers accessed and copied backup files tied to the Fines/Fees and Restitution Enforcement program, a statewide debt collection system. Separately, they got into more than 150,000 reports from the Foster Care Review Board, records with statements from families, investigative findings, and case notes on 8,000 children currently in foster care. Recorded Future News reported that investigators believe the intrusion started the way most do: an employee clicked a link in a phishing email.
Arizona's Supreme Court has been posting updates as the investigation continues, and the broad strokes haven't changed: the data that got out wasn't being actively used by anyone the day the attack happened. It had just been sitting there, outside of anyone's daily attention, for years.
That distinction matters for every state and local agency reading the headlines and wondering if it could happen to them. The question isn't just whether your production systems are locked down. It's whether you can say, with confidence, what sensitive data exists somewhere in your environment that nobody's actively managing.
A hacked application is a known risk you can test for. A forgotten backup is an unknown one, until it isn't.
Retention Without Governance Is Its Own Risk
Every court, agency, and registry has data it can't just delete. Retention schedules, statutes of limitations, and plain institutional caution all push agencies toward keeping records for years, sometimes decades. That part is reasonable. What's not reasonable is treating a thirty-year-old backup the way you'd treat a box in a basement archive: assumed safe mostly because nobody's looking at it.
Backup files often sit outside the access controls, logging, and monitoring built around production systems. Nobody reviews who can open them. Nobody tracks when they're copied or where a copy ends up. A file sitting untouched since 2010 isn't harmless just because it's old. It's had sixteen years to be forgotten by the people who were supposed to be responsible for it.
This is the part procurement leads and compliance officers rarely ask about during a vendor evaluation. They'll ask whether a system encrypts data in transit and at rest. They'll ask about SOC 2 reports and GovRAMP status. They ask less often what happens to a document five years after it stops being actively used, and who's still watching it then.
What a Governed Pipeline Changes
This is the gap AIRLIFT Connect is built to close. Instead of documents and data landing in whatever storage happens to be convenient and staying there indefinitely, a governed pipeline tracks each record from the moment it's captured, an e-signature form, an inbound web request, a source system event, through transformation and delivery to wherever it's supposed to live: Box, SFTP, or another system of record.
The piece that matters most here is the audit trail. Every import moves through a tracked state: queued, downloading, transforming, delivering, completed, with a full timeline attached. If an agency needs to know what data exists, where it moved, and who had access to it, that answer doesn't require a forensic review months after something goes wrong. It's already logged, as it happens, not reconstructed afterward under pressure with investigators on the phone.
Categories like foster care reports and debt collection records, the kind that caused the most damage in Arizona's breach, are exactly where this matters most. They carry details about children, families, and financial obligations that shouldn't be handled with the same loose controls as a routine form submission sitting in a shared drive somewhere nobody's checked in years.
The best time to find out what's actually in your old backups is before a hacker does.
Before the Next Phishing Email Lands
Arizona's court system will spend months and real money on notifications, credit monitoring, and recovery. None of that undoes the fact that the exposed data had been sitting there, unmanaged, for years before anyone clicked the wrong link. The Foster Care Review Board reports alone involved cases dating back to 2010, meaning some of that data outlived the children's entire time in the system it was meant to protect.
Agencies that want a different outcome need to ask a specific question: do we know where every category of sensitive data lives, who can reach it, and when it last moved? If the honest answer involves old backups nobody's reviewed in a long time, that's worth fixing before it becomes a breach notification. cloudPWR built AIRLIFT Connect for exactly this kind of governed, auditable document and data movement. If your agency's intake and retention process could use that kind of visibility, get in touch.