HackingGovernmentGovernmentStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

City of Port Orange

bd_146ec52a88429ca0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 6, 2019

Filed

Jan 10, 2020

To disclose

9 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for City of Port Orange →2 incidents on file

City of Port Orange notified Montana DOJ of a third-party vendor (CentralSquare Technologies) data security incident affecting Click2Gov payment portal. Unauthorized access to payment card info (card number, CVV, expiration) and PII (name, address) occurred Aug 27 - Oct 26, 2019. City engaged forensic investigators, disabled the portal, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 71 days

discovery → filing · 9 weeks / 65 days

Aug 27, 2019

Begins

Nov 6, 2019

Discovered

Jan 10, 2020

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_2a570e766f236de32020-01-10Verified
Indiana State AGbd_8f9c31de7685b9922020-01-10Verified
New Hampshire State AGbd_b696027729f801502020-01-14 · +4dVerified

Name: City of Port Orange
norm: city of port orange
Domain: port-orange.org

Name: City of Port Orange
norm: city of port orange
Domain: port-orange.org
Industry: Governmentllm

Discovered: Nov 6, 2019
Breach occurred: Aug 27, 2019 – Oct 26, 2019
Undetected for: 71 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified relevant regulators
Third party: via CentralSquare Technologies
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic investigators
Discontinued use of the Click2Gov website
Worked to identify individuals who made payments during the affected period
Confirmed and further strengthened the security of its systems
Reviewing security policies and procedures
Working with law enforcement
Notified relevant regulators
Offered twelve-month subscription to free credit monitoring service through TransUnion
Changes made: Strengthened the security of its systems
Reviewing security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(65 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJan 10 · first

Indiana State AGJan 10 · first

Montana State AGJan 10 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-56.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2020
Raw hash: 0510e5cba548b195e8a6022a00a8c48e540cf409bcdcaf6fdca3c522b6503be7

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCity of Port Orange

Victim entityCity of Port Orange

Incidentdiscovered Nov 6, 2019

Stated responseEngaged third-party forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov