---
title: "Data breach at North Carolina Administrative Office of the Courts (NCAOC)"
description: "A WBTV reporter found that North Carolina's online jury service excusal form assigned uploaded documents a sequential URL, so changing a single digit in the web address let anyone view attachments submitted by other applicants. Exposed files included driver's licenses, Social Security numbers, medic"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-23-north-carolina-administrative-office-of-the
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-23
dateModified: 2026-09-23
---
# North Carolina Administrative Office of the Courts (NCAOC)

Data breach — Critical

A WBTV reporter found that North Carolina's online jury service excusal form assigned uploaded documents a sequential URL, so changing a single digit in the web address let anyone view attachments submitted by other applicants. Exposed files included driver's licenses, Social Security numbers, medical records and job-related information, and among them was a rape incident report naming the victim. The NCAOC blocked public access to the pages after WBTV brought the issue to its attention.

The exposed Social Security numbers and ID documents could be used for identity theft or fraudulent account openings, while the report naming a rape victim represents a serious privacy violation for an already vulnerable individual.

| Fact | Value |
| --- | --- |
| Disclosed on | September 23, 2026 |
| Sector | Public sector |
| Country | United States |
| Cause | Misconfigured database |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Full name
- Identity document
- Employment data
- Social security number
- Health data

## What you can do

- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Error on North Carolina jury duty website exposed people’s social security numbers, medical records, more](https://databreaches.net/2026/09/24/error-on-north-carolina-jury-duty-website-exposed-peoples-social-security-numbers-medical-records-more/) — DataBreaches.net
- [Error on North Carolina jury duty website exposed people's social security numbers, medical records, more](https://www.wbtv.com/2026/09/24/error-north-carolina-jury-duty-website-exposed-peoples-social-security-numbers-medical-records-more/) — WBTV
- [North Carolina jury duty website error exposed private information](https://www.wbtv.com/2026/09/23/jury-duty-website-error-exposed-private-information/) — WBTV

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-23-north-carolina-administrative-office-of-the
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees