MalwareGovernmentGovernmentRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountMediumContained

Automatic Funds Transfer Services, Inc.

bd_754c4ed2e84373a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 4, 2021

Filed

Mar 10, 2021

To disclose

5 weeks

Affected

23,935state residents only

Confidence

67%

Skagit PUD notified WA AG of a ransomware attack on third-party vendor AFTS on Feb 4, 2021. 23,935 customers notified on Feb 26. Potential exposure of names, addresses, account numbers, and bank routing/account numbers. AFTS engaged forensics and reported to FBI.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 5 weeks / 34 days

Feb 1, 2021

Begins

Feb 4, 2021

Discovered

Mar 10, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed23,935 affectedView incident

Name: Public Utility District No. 1 of Skagit County
norm: public utility district no 1 of skagit county
Domain: skagitpud.org

Name: Automatic Funds Transfer Services, Inc.
norm: automatic funds transfer services
Industry: Governmentllm

Discovered: Feb 4, 2021
Breach occurred: Feb 1, 2021 – Feb 7, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2021
Affected individuals: 23,935state-resident count only
Data types: Identity (basic)Financial account
Data elements: NameFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: AFTS reported the ransomware attack and potential breach of customer information to both the police and FBINotified Washington State Office of the Attorney General

During the incident: AFTS hired a cybersecurity company to address the ransomware attack and retrieve all of its information
AFTS reported the ransomware attack and potential breach of customer information to both the police and FBI
District took steps to secure our systems and electronic processes between AFTS and our network
District implemented measures to enhance our environment’s security to minimize the likelihood of a similar event occurring in the future
District notified 23,935 water utility customers of the incident
Changes made: Implemented measures to enhance our environment’s security to minimize the likelihood of a similar event occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10420.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 10, 2021
Raw hash: 2bef4572e8a9285676f2686ca551868e4b815faefa0a83fb782cb054bb27af5e

Reporting entityPublic Utility District No. 1 of Skagit County

Victim entityAutomatic Funds Transfer Services, Inc.

Incidentdiscovered Feb 4, 2021

Stated responseAFTS hired a cybersecurity company to address the ransomware attack and retrieve all of its information

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com