Cabarrus County residents who uploaded documents to North Carolina's online jury duty excuse form may have had their Social Security numbers, medical records and driver's licenses publicly accessible, a WBTV investigation first reported Wednesday, Sept. 23.

The flaw affected the statewide NC Courts electronic submission form, the same portal the Cabarrus County jury service page directs residents to use when requesting an excuse or postponement. Anyone could view another person's uploaded documents by changing a single digit in the page's web address.

Zach Duda discovered the vulnerability while using the form after his father's death. He had uploaded a copy of his father's death certificate as supporting documentation. When he received a confirmation email containing a link to his submission, he realized that altering one number in the URL pulled up files belonging to other people.

Duda reported the bug through the N.C. Administrative Office of the Courts' online webmaster forum. He said he never received a response.

"They had an online webmaster forum where you could submit bugs and things of that nature, which I did, but I have yet to hear back," Duda told WBTV.

WBTV's reporters confirmed the flaw, finding dozens of driver's licenses, Social Security numbers, job details and medical records by incrementing the URL one digit at a time. A follow-up report noted the investigation also uncovered a rape incident report that listed a victim's name.

Gwendolyn Solomon, who had uploaded health records to document a scheduled operation, was among those whose private information was exposed. She told WBTV she had assumed her documents were private.

The N.C. Administrative Office of the Courts (NCAOC), which oversees the court system's technology under Chief Justice Paul Newby and Director Ryan Boyce, blocked public access to the uploaded documents within days of WBTV's inquiry. A spokesperson said the office restricted unauthorized access and called the form and its data repository secure.

The NCAOC declined interview requests from WBTV. The agency has not said how long the vulnerability existed, how many people's records were exposed, or whether it considers the incident a security breach.

That last question carries legal weight. North Carolina General Statute § 75-65 requires entities that hold residents' personal information to notify affected individuals "without unreasonable delay" after a breach. Whether the statute applies to the state judiciary has not been resolved in available records.

This is not the first security issue tied to the NCAOC. Twice in 2025, virtual court hearings in Mecklenburg County were hijacked by individuals who displayed racist and pornographic material, WBTV reported.

Cabarrus County residents who submitted sensitive documents through the form can also send future excuse requests by mail or fax to Chief District Court Judge Christy E. Wilhelm at P.O. Box 70, Concord, NC 28026. No Cabarrus County residents have been publicly identified among those whose documents were exposed.