CourtSmart Listed by medusalocker Ransomware Group

On May 5, 2026, CourtSmart appeared on the leak site of the medusalocker ransomware group. The company, which supplies courtroom recording and transcription technology, had internal files exfiltrated from its development server at dev-rich20.courtsmart.com. Anyone whose court hearings, legal transcripts, or administrative records passed through CourtSmart’s systems may now have personal information exposed.

Confirmed Facts from Reporting

Public reporting indicates that attackers gained access to CourtSmart’s development environment and removed an unknown volume of internal documents. The domain courtsmart.com and its COURTSMART2 infrastructure were listed, along with noted connections to JIS.org and nashville.org. No confirmed count of affected individuals has been released, but the nature of the company’s work means sensitive case-related data for everyday people who appeared in court was likely present. The medusalocker group published the listing on its dark-web leak site, giving victims a short window before full data release.

Why This Matters for You and Your Family

Court records often contain full names, addresses, dates of birth, phone numbers, Social Security numbers, and financial details. When those files leave a vendor’s network, the information does not disappear. It can surface weeks or months later on forums, in identity-theft kits, or as the starting point for targeted scams. If you or a family member have been involved in any legal proceeding that used digital recording or transcription services, your data may already be in circulation. Children’s names linked to family court matters are especially attractive to criminals who build long-term profiles.

The Doxxing and Identity-Chain Risk

A single court file can connect an email address to a physical address, a phone number, and family members. Attackers then cross-reference that data with credentials stolen in other breaches. The result is an identity chain: one leaked court document leads to gaming accounts, school portals, or social-media profiles. Public reporting shows these chains frequently end in doxxing, account takeovers, or extortion demands directed at ordinary households. Credential leaks like the CourtSmart incident routinely cascade into gaming account compromises because the same email and password combinations are reused across services.

Medusalocker’s Publicly Known Track Record

Public reporting attributes medusalocker’s emergence to late 2024. The group has targeted healthcare providers, local governments, and technology vendors that handle sensitive personal records. Its typical playbook begins with initial access to development or remote-desktop systems, followed by exfiltration of internal files, then publication on its leak site with a short payment deadline. If ransom is not paid, the group dumps the data and moves on. Exact prior victim counts remain unclear, but available reporting describes a pattern of hitting mid-sized service providers whose compromise quietly exposes thousands of ordinary citizens.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the no-subscription cleanup to remove what you can.
• Rotate the password you used on any CourtSmart-connected service anywhere it is reused, and switch on 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails exposed in incidents like this.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate with operators yourself.

The CourtSmart breach is a reminder that vendors you never directly signed up with can still put your family at risk. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process today turns a passive leak into a managed remediation before the next phase of abuse begins.