The U.S. Supreme Court's electronic filing system was accessed repeatedly by an unauthorized intruder who used stolen credentials, according to a Justice Department account relayed by traur.org, which credits reporting by BleepingComputer. The suspect, 24-year-old Tennessee resident Nicholas Moore, is said to have admitted to the intrusions after publicising them himself: he posted screenshots of victim data to an Instagram account operating under the handle @ihackedthegovernment. The same account reports 25 unauthorized logins over a three month window, sometimes several in a single day, plus separate intrusions at AmeriCorps and the Department of Veterans Affairs. Readers should note the sourcing caveat up front: the breach narrative in this brief rests on a single lower confidence aggregator citing DOJ statements, and no Supreme Court statement, indictment text, or federal press release is present in the source set reviewed here. Everything below is attributed accordingly.
What Happened
Per the traur.org account, Moore obtained valid credentials for the Supreme Court's restricted electronic filing system and used them to log in roughly 25 times across approximately three months, in some cases multiple times per day. The report characterises the Justice Department as the source for the stolen credential detail and for the intrusion count.
The operational failure that ended the campaign was entirely self inflicted. Rather than monetise or quietly hold the access, the actor published screenshots of what he had reached, including victim names and filing system details, to a public Instagram account whose handle openly advertised the activity. That trail is described as the thread that led investigators to him.
Two other federal targets appear in the same account: an AmeriCorps account from which personal data was taken, and a Department of Veterans Affairs health record portal that exposed at least one veteran's private medical information. Whether the same credential source or technique was used across all three has not been established in the material available.
Accounts differ in one important respect. The incident is framed as a "Supreme Court data breach," but the specifics described amount to repeated unauthorized access to a filing system rather than a mass exfiltration event. No record count, no case sealing impact, and no confirmation of access to non public deliberative material appears in any source reviewed. Defenders should treat the scope as unresolved.
What Was Taken
There is no published volume figure for this incident. The only data types named in the available reporting are:
- Names of individuals appearing in the Supreme Court electronic filing system, along with filing system details, published as screenshots to Instagram (traur.org, citing DOJ).
- Personal data from a compromised AmeriCorps account (traur.org).
- A veteran's private health information from a VA health record portal (traur.org).
Sensitivity here is driven by context rather than volume. Court filing metadata can reveal party identities, counsel, and case posture; VA health records are protected health information about a population already targeted by benefits fraud. A single exposed veteran record is a materially different harm profile from a bulk healthcare breach, and the reporting supports the former, not the latter.
No source in this set gives a competing record count, so there is no range to state. The absence of a number is itself the finding: nobody has published one.
Why It Matters
The intrusion lands against a judiciary that had already told Congress, in public, that it was outgunned. On 14 July 2026, Justices Elena Kagan and Amy Coney Barrett testified before House and Senate appropriations subcommittees, the first Supreme Court testimony on Capitol Hill since 2019 (ABC News, The Hill, NBC News, Deseret News). Barrett told the Senate subcommittee that the Court fielded more than 200 million attempts to breach its systems in the prior year, and that the figure was on track to double as AI lowers the cost of vulnerability discovery, according to Broadband Breakfast. "AI is making it easier for people to find vulnerabilities in all systems and exploit that," she said in that account.
The budget figures reported around that hearing do not agree, and the discrepancy is worth stating plainly. ABC News and The Hill cite a $228 million FY2027 request, up roughly 10 percent. Deseret News gives $228.4 million against a current $207.8 million. The Amazing Times, citing the Congressional Research Service, puts the appropriation request at $225.1 million split into $207.0 million for salaries and expenses and $18.1 million for care of the building and grounds, while separately noting a $228 million figure with a 10 percent increase in an image caption. The likely explanation is different accounting boundaries between the topline request and the CRS scored appropriation, but the sources as written conflict.
Within that request, the cybersecurity slice is small. The Amazing Times reports roughly $2.3 million allocated to cybersecurity against $14.6 million for the Court's police department and building security and $6.5 million for an off site visitor screening facility. Broadband Breakfast reports the Court is looking to hire 12 cybersecurity officials. Twelve people and about $2.3 million is the defensive posture behind a system its own justices describe as absorbing hundreds of millions of intrusion attempts annually.
The strategic lesson for defenders is not that a sophisticated adversary broke the Supreme Court. It is that, if the reporting holds, a 24 year old with valid credentials walked in 25 times over three months and was caught by his own social media rather than by detection. Barrett also warned that lower courts have suffered breaches in the past year and that a compromise at the highest court could carry national security consequences.
The Attack Technique
The technique described is credential abuse, not exploitation. Per the DOJ account relayed by traur.org, the actor used stolen credentials to authenticate to a restricted system. No vulnerability, malware family, or initial access broker is named, and the origin of the credentials is not stated in any available source.
That places this incident in the highest volume, lowest sophistication category of federal intrusion: valid account access (MITRE ATT&CK T1078) against an internet reachable application. The detection failure implied by 25 logins over three months, some clustered on the same day, points at absent or unreviewed anomaly detection on session origin, velocity, and behavioral baseline, rather than at any technical defensive gap in the authentication layer itself.
For contrast on what a genuinely sophisticated campaign looks like in the same period, Dark Reading reported on 13 August 2026 that a suspected APT actor began exploiting CVE-2026-59310, a critical directory traversal flaw in VMware vCenter carrying a 9.8 CVSS score, on 3 August, less than a week after Broadcom's 29 July disclosure. German incident response firm QUIRSO traced the activity to 47 countries and 361 unique IP addresses, with the U.S., France, Iran, and Turkey most heavily targeted, and cautioned that the IP count overstates precision because some addresses belong to shared cloud and hosting infrastructure. QUIRSO also warned that patching alone may not be sufficient because the actor establishes post exploitation persistence. That campaign is unrelated to the Supreme Court incident and appears in this brief only as context for the current federal threat environment.
What Organizations Should Do
- Enforce phishing resistant MFA on every externally reachable filing, records, and case management portal. Stolen credentials are only decisive where a second factor is absent or bypassable. Prioritise systems that expose third party personal data over internal tooling.
- Alert on authentication velocity and session anomalies, not just failures. Twenty five successful logins across three months went unremarked. Baseline each privileged account for normal login frequency, geography, device, and hour, and alert on deviation from the account's own pattern rather than on generic thresholds.
- Audit credential provenance for accounts holding sensitive records. Review which accounts have access to filing systems and health record portals, when their credentials were last rotated, whether they are shared, and whether any appear in commodity infostealer dumps.
- Instrument bulk read and screenshot scale access as a detection signal. The exposed data reached Instagram as screenshots, meaning the actor viewed records interactively at volume. Log and rate limit record views per session on any portal exposing PII or PHI.
- Patch CVE-2026-59310 and hunt for persistence afterward. If you run VMware vCenter, apply Broadcom's fix and then hunt independently. Dark Reading and QUIRSO both stress that patching does not remove an established foothold.
- Pressure test your funding assumptions against your attack surface. The Court's own numbers, roughly $2.3 million and 12 planned hires against a stated 200 million annual intrusion attempts, are a public example of a defensive budget scaled to headcount rather than threat volume. Run the same ratio for your own environment before the next budget cycle, not after an incident.
Sources: Hacker's Instagram Bragging Leads to Arrest: Supreme Court Data Bre... | Global Threat Campaign Hits Critical VMware vCenter Flaw | Supreme Court Justices Want to Add Staff to Combat Cyber Threats | Justices pitch lawmakers on enhanced security in rare Hill appearan... | Supreme Court justices testify, asking Congress for higher security... | Supreme Court justices ask Congress for additional security funding | Why the Supreme Court Just Asked Congress for $225 Million in Emerg... | Amy Coney Barrett and Elena Kagan detail budget increase amid high...