MalwareGovernmentGovernmentRansomwareData ExfiltratedCustomer Data InvolvedMulti-Stage ChainFinancial accountIdentity (basic)PIIMediumActive

City of Lacey

bd_7447b1fefe9f7061 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 24, 2019

Filed

Nov 15, 2019

To disclose

22 days

Affected

6,209state residents only

Confidence

69%

Full breach record for City of Lacey →

Supplemental notice from City of Lacey, WA regarding a cyberattack on its utility billing payment portal. Malicious actors installed malware to compromise payment card data from Aug 27 to Oct 28, 2019. Incident discovered Oct 24, 2019. 6,209 customers potentially affected. City shut down portal, engaged forensic firm, and cooperated with law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 58 days

discovery → filing · 22 days

Aug 27, 2019

Begins

Oct 24, 2019

Discovered

Nov 15, 2019

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6,209 affectedView incident

Name: City of Lacey
norm: city of lacey

Name: City of Lacey
norm: city of lacey
Industry: Governmentllm

Discovered: Oct 24, 2019
Breach occurred: Aug 27, 2019 – Oct 28, 2019
Undetected for: 58 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 4, 2019
Affected individuals: 6,209state-resident count only
Data types: Financial accountIdentity (basic)PII
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Consumer Protection Division
Initial access: exploit_public_facing

During the incident: Shut down the online utility bill payment system
Working with an outside security firm to test the system
Working with law enforcement to respond to this incident
Notified potentially impacted customers by email, website, and social media
Cooperating with law enforcement
Changes made: Started a new payment portal on January 22, 2020
Mitigated exposure points
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10518.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2019
Raw hash: 7d7d1d4f208537f09ba5972577b89635dd565fad0bc8c52f4356bb4cbc636d67

Reporting entityCity of Lacey

Victim entityCity of Lacey

Incidentdiscovered Oct 24, 2019

Stated responseShut down the online utility bill payment system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com