A vulnerability on North Carolina's online jury duty system exposed sensitive personal information for an unknown period, including Social Security numbers, driver's licenses, and private medical records. The issue, which allowed public access to documents uploaded by individuals seeking jury duty exemptions, was rectified by state officials after a media investigation brought it to their attention.
The exposed data included highly personal details such as Social Security numbers, copies of driver’s licenses, medical records detailing health issues and scheduled operations, and private information about people’s jobs. In one instance, a rape incident report listing a victim’s name was found among the accessible files. This sensitive material was part of documents North Carolina residents submitted through an online form to request exemptions from jury duty.
Zach Duda discovered the vulnerability while filling out an online jury excuse form for himself. He was handling his father's estate and uploaded a copy of his father's death certificate as proof. Duda realized that the documents he uploaded had a URL on the NC Courts website, and by altering the web address by a single number, he could access documents uploaded by other people. He noted this “pretty dangerous pattern of information” and warned it “could be even worse if that got automated.”
A subsequent investigation confirmed Duda's findings, revealing dozens of copies of sensitive documents by incrementally changing numbers in the web address. Gwendolyn Solomon, who had an operation scheduled when she was summoned for jury duty, found her private health information among the records. Solomon expressed surprise, stating, “No, because I’m thinking it’s supposed to be private,” and urged the court system to “get it right and have more privacy.” She added, “We’re not protected. It doesn’t seem like we’re protected.”
Duda stated he attempted to notify the webmaster for the North Carolina Administrative Office of the Courts (NCAOC) about the vulnerability through an online forum but never received a response. He said he “yet to hear back” after submitting bugs and similar issues.
Within days of inquiries directed to the NCAOC, the webpages linked to the jury excuse documentation were blocked from public access. A spokesperson for the NCAOC confirmed that the organization had restricted unauthorized access to information submitted via the judicial branch's online jury excusal form. The spokesperson maintained that the webform itself, as well as the repository of information collected through it, is secure. However, the NCAOC has declined requests to interview its officials regarding the duration of these web vulnerabilities or the extent of compromised information. The organization also did not respond to questions regarding whether it considers the incident a security breach, which would necessitate notifying all potentially impacted individuals under state law.
This is not the first instance of website vulnerabilities making headlines for the NCAOC, which is overseen by North Carolina Supreme Court Chief Justice Paul Newby and Director Ryan Boyce. In 2025, virtual web hearings conducted in Mecklenburg County were disrupted twice when “trolls” infiltrated them, sharing racist and pornographic material. Ja’El Mosley, who witnessed one of these incidents, described how “this porn came up on the screen” “just out of nowhere,” calling it “disgusting.” The recent exposure of sensitive jury duty information adds to a pattern of security concerns for the state’s judicial branch online systems. The lack of transparency from the NCAOC regarding the scope and implications of the recent data exposure leaves many questions unanswered for North Carolina residents whose private information may have been compromised.
