North Carolina Administrative Office of the Courts (NCAOC)

CriticalConfirmedPublic sectorSeptember 23, 2026

A WBTV reporter found that North Carolina's online jury service excusal form assigned uploaded documents a sequential URL, so changing a single digit in the web address let anyone view attachments submitted by other applicants. Exposed files included driver's licenses, Social Security numbers, medical records and job-related information, and among them was a rape incident report naming the victim. The NCAOC blocked public access to the pages after WBTV brought the issue to its attention.

The exposed Social Security numbers and ID documents could be used for identity theft or fraudulent account openings, while the report naming a rape victim represents a serious privacy violation for an already vulnerable individual.

Disclosed on: September 23, 2026
Sector: Public sector
Country: United States
Cause: Misconfigured database

Exposed data

Full name
Identity document
Employment data
Social security number
Health data

You are only affected if you had an account or an order with this organisation.

What you can do

These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact