A cyberattack on Arizona’s court system has stolen personal information of about 1.3 million people. The attack is believed to have started on September 24 when a court employee clicked a malicious link in a phishing email. Court IT staff shut it down about two hours after spotting it.

The data was copied from a backup server. It covered people with unpaid court fees, fines and restitution payments going back 30 years. The attackers also took nearly 30,000 protective orders and 150,000 foster care board reports dating back to 2010.

The Arizona Supreme Court said there is no evidence the data has been used or shared. The copied data was highly compressed and encrypted. No court records were altered or deleted. No cases have been delayed. The FBI is investigating. The court has notified those affected and set up a call centre. Officials have advised affected people to freeze their credit files and watch for identity theft.