HackingGovernmentGovernmentStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

City of Tucson, AZ

bd_2f84f901a380587b · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 29, 2022

Filed

Sep 29, 2022

To disclose

18 weeks

Affected

664state residents only

Linked

8 filings

Confidence

68%

Full breach record for City of Tucson, AZ →

City of Tucson, AZ notified Washington AG of unauthorized access to a user's network credential starting May 17, 2022. Suspicious activity discovered May 29, 2022. Files copied Aug 4, 2022. Names and SSNs exposed. 664 Washington residents notified starting Sept 23, 2022. Forensic specialists engaged; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d18 weeks discovery → filing

Incident timeline

undetected · 12 days

discovery → filing · 18 weeks / 123 days

May 17, 2022

Begins

May 29, 2022

Discovered

Sep 29, 2022

Filed

vs. sector median

+7 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_2bf2cdcf1809778e2022-09-29Candidate
Indiana State AGbd_47729ac078fefd722022-09-29Verified
Massachusetts State AGbd_6df8a0884803e71c2022-09-29Verified
Montana State AGbd_88191b6f9a91212c2022-09-29Verified

Show 3 more filings ↓up to 4d gap

Maine State AGbd_a46baffbbf759cc12022-09-29Verified
Oregon State AGbd_aab06bc719aecdfc2022-09-29Verified
New Hampshire State AGbd_7d660cc84e5dfe062022-10-03 · +4dVerified

Name: City of Tucson, AZ
norm: city of tucson az

Name: City of Tucson, AZ
norm: city of tucson az
Industry: Governmentllm

Discovered: May 29, 2022
Breach occurred: May 17, 2022 – May 31, 2022
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 23, 2022
Affected individuals: 664state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDriver's licence numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Worked with third party forensic specialists to review City systems
Undertook a comprehensive review of the information potentially at issue
Worked to locate address information for the potentially affected individuals
Providing access to credit monitoring services for one (1) year, through Experian
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Working to implement additional safeguards and training to its employees
Reviewing our existing policies and procedures regarding cybersecurity and evaluating additional measures and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(123 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGSep 29 · first

Indiana State AGSep 29 · first

Massachusetts State AGSep 29 · first

Montana State AGSep 29 · first

Maine State AGSep 29 · first

Oregon State AGSep 29 · first

Washington State AGSep 29 · first · this page

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA15459.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 29, 2022
Raw hash: feb84c1d96b5480523a9f080daf0b41ab9b6d9d9920e3a4451c9fc6ff94f98ad

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityCity of Tucson, AZ

Victim entityCity of Tucson, AZ

Incidentdiscovered May 29, 2022

Stated responseWorked with third party forensic specialists to review City systems

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com