PENTESTY · EDITORIAL ANALYSIS · · 4 min read
C-Track: does document confidentiality follow every access path?
A platform remaining available does not demonstrate that confidential files stayed protected. Verify where classification must be respected throughout the document workflow.
By Pentesty
What the official notices establish
C-Track notices in the United States and Canada report discovering unauthorized activity on June 30, 2026 and the acquisition of certain files in March. They say confidential, redacted or sealed information may have been affected for some courts. On September 2, Ontario's courts recorded uncertainty about the content and number of individuals involved. These documents do not establish a public initial access vector.
Translate confidentiality into version and recipient decisions
In Pentesty's analysis, the same question applies to a corporate legal department: who may consult the draft, signed version and restricted attachment? Being authorized to follow a case or contract does not automatically define access to every associated document. Describe the rules for each document class with the person responsible for its use.
Build a matrix of document, version, purpose and recipient. Include internal staff, contracted counsel, administrators and business integrations. Define authorization and duration for support exceptions. Document provenance governance helps review incoming material; here, the assessment follows who receives it after it enters the system.
Follow the document beyond its main page
Choose an authorized workflow and identify the available methods: viewing, previews, searches, exports and delivery to another service. Record what each method should reveal. A file hidden from a listing may still require checks through another path; that is a test hypothesis, without claiming it caused the C-Track incident.
Distinguish the complete version from one with information removed for a particular recipient. Also check titles, descriptions and search results where they are in scope. Acceptance criteria should identify which fields may appear in each response, rather than relying solely on the absence of a download button as evidence of restriction.
Use synthetic documents to verify boundaries
Create a fictional collection containing widely shared documents, restricted attachments and versions prepared for sharing. Use test identities with different roles and combinations authorized in advance. Preserve the expected rules before execution so that the observed outcome does not retrospectively become the approved behavior.
- Reading: compare the response for an authorized reader with one for someone permitted only to follow the matter.
- Distribution: track the version and fields reaching the integration's controlled receiver.
- Change: alter the test document's classification and check relevant existing access paths.
- Termination: remove temporary access and verify new requests without presuming deletion of earlier copies.
Connect technical results to service ownership
The discussion of prompt injection in a judicial context adds another concern: incoming content also needs handling appropriate to its purpose and trust. The permission assessment should remain valid when automation processes a file instead of a person reading it. Define what the integration may receive and produce.
Retain evidence of the rule, configuration, identity and observed response, restricting access to the report. Where a provider administers part of the path, request evidence appropriate to that responsibility and record what remained outside reach. Availability, confidentiality and incident investigation are separate assessments; continued service does not, by itself, settle the other questions.
Frequently asked questions
Do the notices reveal how the attacker entered C-Track?
The cited notices describe unauthorized activity and affected files, but do not establish a public initial access vector. The proposed tests are business analysis, without assigning their hypothesis to the incident.
Was every court document exposed?
The sources describe a subset of records and potential information categories. Do not extrapolate that to all documents, people or courts, or treat uncertainty as proof of no impact.
Does hiding the download button demonstrate confidentiality?
Assess responses through the authorized paths in scope, including searches, previews or integrations where available. The interface alone does not demonstrate how those other methods behave.
Are real court proceedings needed for the test?
The proposal uses synthetic documents, identities and receivers. Any assessment of a real environment requires authorization, evidence protection and exclusions agreed with its owners.
Sources and references
- C-Track: official United States notice
- C-Track Canada: official notice
- Ontario courts: September 2 statement
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.