A website that aggregates court cases nationwide has published 260,000 confidential attorney discipline records, the State Bar of California said Saturday, Feb. 26.

The data breach by shadowy judyrecords.com was first discovered Friday by the State Bar.

“We apologize to anyone who is affected by the website’s unlawful display of nonpublic data,” Leah Wilson, executive director of the State Bar, said in a statement. “We take our obligations to protect confidential data with the utmost seriousness, and we are doing everything we can to ensure that we resolve this issue quickly and prevent any such breaches from recurring. We intend to act quickly to provide any necessary disclosures to affected individuals.”

In addition to limited data on attorney discipline records, judyrecords.com also published about 60,000 public State Bar court case records. The site also appears to display confidential court records from other jurisdictions, the State Bar said.

Under state law, all attorney disciplinary investigations are confidential until formal charges are filed and a court proceeding is initiated.

“The nonpublic case profile data from the State Bar appears to have been displayed on this public website in violation of this statute,” the State Bar said. “It includes case number, file date, case type, case status, and respondent and complaining witness names. It does not include full case records. We do not yet know how many attorney or witness names were disclosed.”

The State Bar said it is taking the following steps steps to address the breach, including:

Retaining a team of information technology forensics experts to assist in an investigation.
Tasking its case management system software vendor, Tyler Technologies, to investigate and remediate any issues in its Odyssey case management software.
Requesting judyrecords.com website’s hosting provider and domain name registrar to immediately remove the confidential data.  Direct contact for judyrecords.com is not readily available, according to the State Bar.
Notifying law enforcement of the breach.

The State Bar also has set up a web page to provide ongoing updates and answer questions at calbar.ca.gov/data-breach.

As of Saturday evening, the compromised attorney discipline records remained visible on the judyrecords.com website. Efforts to contact judyrecords.com were unsuccessful.