HackingGovernmentGovernmentBackdoor / C2Capture Stored DataSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

City of Bakersfield

bd_68989e561f8876bd · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Nov 12, 2018

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for City of Bakersfield →2 incidents on file

The City of Bakersfield disclosed that an unauthorized party inserted malicious code into its Click2Gov online payment system, developed by third-party vendor CentralSquare Technologies. The code captured payment card data (card number, expiration, CVV) and personal information (name, address, email) from users making payments between August 11, 2018, and October 1, 2018. The City removed the code, initiated a security review, contacted law enforcement, and is enhancing security protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 11, 2018

Begins

Nov 12, 2018

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_d59a5801ba5643292018-11-12Verified

Name: City of Bakersfield
norm: city of bakersfield

Name: City of Bakersfield
norm: city of bakersfield
Industry: Governmentllm

Discovered: —
Breach occurred: Aug 11, 2018 – Oct 1, 2018
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Third party: via CentralSquare Technologies
Initial access: supply_chain

During the incident: Immediately removing the malicious code from the Click2Gov online payment system
Initiating an expanded security review with CentralSquare
Contacted law enforcement and is continuing to support law enforcement’s investigation
Changes made: Enhancing our existing security protocols
Re-educating our vendors on the importance of protecting personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 12 · first

California State AGNov 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-141746
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2018
Raw hash: 08e257455799c8f0d8c307e420ff19520a7c448f4d972802e2604f781ae413dc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCity of Bakersfield

Victim entityCity of Bakersfield

IncidentThird-Party / Supply Chain

Stated responseImmediately removing the malicious code from the Click2Gov online payment system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov