San Joaquin County Superior Court
San Joaquin County Superior Court cyberattack
Summary
An October 2024 cyberattack disrupted San Joaquin County Superior Court communications, filings, payments and remote proceedings. The court later confirmed theft of files containing personal information.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Remote access disruption
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Transaction processing disruption
Business, financial, customer, administrative, or operational transactions could not be completed normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
San Joaquin County Superior Court isolated its systems from the internet after a cybersecurity incident disrupted court operations in October 2024. The court’s Oct. 30 public notice described significant connectivity problems and postponed matters scheduled for remote appearances that day. An Oct. 31 notice confirmed the cyber incident and said part of the network remained offline.
Operational significance
Unavailable services included phone and fax communications, juror reporting information, remote appearances, electronic filing, the website and online services, and credit card processing. Jurors in specified groups were excused.
The court continued operating through alternatives. Its Nov. 3 update said clerk’s offices remained open, paper filings were accepted, and most calendars would proceed. It provided substitute arrangements for certain civil and probate proceedings. Pending electronic filings requiring payments could not be processed normally, although filing dates would be preserved. Releases of some driver’s license holds could take up to two weeks.
Recovery was partial. Stocktonia reported Nov. 22 that online case search, public-record requests and juror updates had returned after remaining unavailable through Nov. 8. The latest court update cited by the report still listed the InfoShare document-sharing platform as offline. The article does not establish an exact final restoration date.
In a Nov. 7, 2025, disclosure, the court said an unauthorized person had accessed its systems between Oct. 25 and Oct. 30, 2024, and acquired copies of files. Depending on the individual, the files contained names together with government identification, financial account, payment card, medical or health insurance information. This disclosure concerns the same 2024 incident.
Confidence and uncertainty
Confidence is high that a cyber incident disrupted court services and involved acquisition of personal information, based on the court’s original notices. The reviewed evidence does not establish ransomware, a responsible group, a ransom demand or the number of affected individuals.
Analytic gaps
The incident is presumed resolved, but the precise date all services returned remains unverified. The Nov. 22 report is the latest reviewed public signal of incomplete recovery, describing InfoShare as offline in an update from the previous week. It does not establish continuous downtime through Nov. 22.
Organizations involved
Impacted locations
French Camp, California
Official Juvenile Justice Center page gives 535 W. Mathews Road, French Camp. Exact Census street match confirms French Camp CDP 0626028 within San Joaquin County 06077. OSM relation 2314380 is classified boundary/cenus, not administrative, and node 150971837 is not a jurisdiction boundary; neither is submitted. Structured municipality/community fallback used without OSM-derived fields. County General Plan pages 142–143 support geographic profile; planning area is not asserted identical to Census CDP. Current site anchor, not separate county probation/hospital/jail intrusion. Court-wide service interruption and clerk alternatives are established by original Oct. 31/Nov. 3 notices; this maps operating places without asserting every service at every building ceased.
Lodi, California
Official Lodi branch page identifies two buildings, 217 W. Elm Street, second floor, and 315 W. Elm Street. Both are represented by one Lodi place, not facility records. Census unexpectedly substituted East Elm for both West Elm requests; those results are not exact street verification. Official branch addresses and exact Lodi administrative boundary establish the place. Current address is not independent proof of 2024 building occupancy. Court-wide service interruption and clerk alternatives are established by original Oct. 31/Nov. 3 notices; this maps operating places without asserting every service at every building ceased.
Manteca, California
Official branch page gives 315 E. Center Street, Manteca; Census normalized address gives Manteca city 0645484/San Joaquin County 06077. Current operating anchor; no distinct building intrusion or facility record inferred. Court-wide service interruption and clerk alternatives are established by original Oct. 31/Nov. 3 notices; this maps operating places without asserting every service at every building ceased.
San Joaquin County, California
Official court services and administration pages establish the state trial court’s countywide judicial remit. This pairs the affected court with San Joaquin County as its service geography; it does not establish county government compromise, universal outage, or compromise of every courthouse. San Joaquin County OSM relation 396467 is an exact administrative boundary; existing California/United States reused.
Stockton, California
180 E. Weber Avenue, Stockton. Original Oct. 30, 2024 notice masthead establishes the administrative site during the incident; current official branch/administration pages agree. Census returns Stockton city 0675000 and San Joaquin County 06077. Court-wide service interruption and clerk alternatives are established by original Oct. 31/Nov. 3 notices; this maps operating places without asserting every service at every building ceased.
Sources
The October 2024 court incident disrupted communications, remote appearances, e-filing, juror information and payment services.
The court announced unavailable communications, remote appearances, e-filing, online services and card processing. Remote matters scheduled for Oct. 30 would be continued.
The court confirmed a cybersecurity incident, internet isolation, part of the network offline and manual workarounds, with communications and online services unavailable.
The report describes rescheduled remote appearances, internet isolation and unavailable phone, fax, filing, jury information, website and payment services.
Online services remained unavailable, clerks used in-person, phone, mail and paper alternatives, and selected jury groups were excused. Most calendars continued.
Case search, public-record requests and jury updates had returned; InfoShare remained unavailable in the latest court update cited by the report.
An unauthorized person accessed court systems Oct. 25–30, 2024, and acquired file copies containing varying personal, financial and health information.
The court describes unauthorized access and file acquisition during Oct. 25–30, 2024, and protection offered to affected individuals.
See something that needs correction?
Signed-in members can report an error, update, or missing source.