photo by: Kansas Judicial Branch

The Kansas Supreme Court justices are pictured in this undated photo. Back row, left to right: Keynen "K.J." Wall Jr., Caleb Stegall, Evelyn Z. Wilson, Melissa Taylor Standridge; front row, left to right: Eric S. Rosen, Marla Luckert, Dan Biles.

The Oct. 12 “security incident” that disrupted access to information systems used by courts statewide was the result of a “sophisticated foreign cyberattack,” the Kansas Supreme Court said in a statement Tuesday, calling the attack “evil and criminal.”

During the attack the cybercriminals also stole data and threatened to post it to a dark website if their demands were not met, the statement said. “We are working with cybersecurity experts to identify the data quickly and securely so we can conduct a comprehensive review to determine the full scope of what personal information the cybercriminals may have stolen.”

The attack, which the court had been largely mum about, incapacitated Kansas Office of Judicial Administration information systems, affecting daily operations of the state’s appellate courts and district courts in 104 counties.

The court said that when it discovered the attack it quickly “disconnected our information systems from external access.”

“We notified state authorities,” the statement said, “and since that time have benefited from the continued support provided by the governor’s office, legislative leadership, and state and federal law enforcement. This attack–on one of our three branches of government–was made against all Kansans.”

The statement said that based on a preliminary review, it appears that the stolen information includes Office of Judicial Administration files, district court case records on appeal and other data, “some of which may be confidential under law.”

A full review is a high priority, the court said, but it will take time.

“Once this review is complete, we will notify those affected,” the statement said.

It added that the information system was being fortified against future attacks and the court expected it to take several more weeks to return safely to normal operations, including electronic filing.

“This assault on the Kansas system of justice is evil and criminal. Today, we express our deep sorrow that Kansans will suffer at the hands of these cybercriminals,” the statement, issued by the state’s seven Supreme Court justices, said.

Of the state’s 105 counties, only one was spared. Johnson County, the state’s most populous county, operates its own computer systems and had not yet switched over to the state’s new online court system.

The justices noted that cyberattacks on government entities are “rampant,” with government being “the third most-targeted sector for such attacks.” They called cybercrime a persistent and serious threat to democracy.