HackingGovernmentGovernmentSkimmerStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

City of Bakersfield

bd_375a81e6fe64e445 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 4, 2019

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for City of Bakersfield →2 incidents on file

The City of Bakersfield experienced a data breach involving its online payment system, Click2Gov, developed by third-party vendor CentralSquare Technologies. An unauthorized party inserted malicious code (a skimmer) into the system between July 30, 2019, and September 5, 2019, capturing payment card data, names, addresses, and email addresses. The city removed the code, engaged forensic investigators, contacted law enforcement, and is transitioning to a new payment vendor.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 30, 2019

Begins

Oct 4, 2019

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d426fefedab884752019-10-04Verified

Name: City of Bakersfield
norm: city of bakersfield

Name: City of Bakersfield
norm: city of bakersfield
Industry: Governmentllm

Discovered: —
Breach occurred: Jul 30, 2019 – Sep 5, 2019
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Removed the malicious code from the Click2Gov online payment system
Initiated an expanded security review with CentralSquare and a leading data forensics firm
Contacted law enforcement and is continuing to support law enforcement’s investigation
Ending its relationship with Click2Gov
Working to transition to a new vendor for city payment processing
Changes made: Updated its computer systems to protect against future insertion of the unauthorized code
Enhancing our existing security protocols and implementing additional security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 4 · first

California State AGOct 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-183190
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2019
Raw hash: 179eff1944dcac3f120d883acaca140a8c3037024ea1d6ea42323f23688c9693

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCity of Bakersfield

Victim entityCity of Bakersfield

IncidentThird-Party / Supply Chain

Stated responseRemoved the malicious code from the Click2Gov online payment system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov