HackingGovernmentGovernmentStolen CredentialsSkimmerSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMediumContained

The City of Sioux City, Iowa

bd_81ea640f43c4d686 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 17, 2020

To disclose

—

Affected

3,563scope not determined

Linked

3 filings

Confidence

65%

Full breach record for The City of Sioux City, Iowa →

The City of Sioux City, Iowa, reported a data security incident involving its Click2Gov payment portal, managed by third-party vendor Click2Gov. Malicious code inserted into the site potentially captured payment card information (name, address, card number, CVV) from 3,563 accounts between August 26 and September 18, 2019. The City engaged forensic investigators, strengthened security, switched vendors, and notified affected individuals, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 26, 2019

Begins

Jan 17, 2020

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_a84d9de7ba27168a2020-01-17Verified
South Carolina State AGbd_c4bffa1ffa9dec6c2020-02-06 · +20dVerified

Name: City of Sioux City, Iowa
norm: sioux city
Domain: sioux-city.org

Name: The City of Sioux City, Iowa
norm: the city of sioux city iowa
Domain: sioux-city.org
Industry: Governmentllm

Discovered: —
Breach occurred: Aug 26, 2019 – Sep 18, 2019
Materiality determined: —
Notification sent: Jan 17, 2020
Affected individuals: 3,563scope not determined
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1056 Input CaptureT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Launched an investigation to determine its full nature and scope
Engaged third-party forensic investigators
Worked with the third-party vendor responsible for the payment application to ensure the security of the Click2Gov website moving forward
Took steps to confirm and further strengthen the security of our systems, including our online utilities payment portal
Engaged a different third-party vendor to process credit card payments
Notified law enforcement regarding any criminal investigation
Directly notifying those individuals whose payment information may be impacted
Sent notice via letter to potentially impacted individuals
Provided free credit monitoring through TransUnion for all individuals impacted for twelve months
Changes made: Reviewed security policies and procedures
Strengthened the security of systems including the online utilities payment portal
Switched payment processing vendor
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGJan 17 · first

Montana State AGJan 17 · first · this page

South Carolina State AG+20d

Pattern: first filing Jan 17 (WA), last Feb 6 (SC) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/CON-CON-CON.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 17, 2020
Raw hash: 7557a32d1411e91e42aa9579c4e5f6a29891e112f091eb9b9a92c9420d5b4460

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCity of Sioux City, Iowa

Victim entityThe City of Sioux City, Iowa

IncidentThird-Party / Supply Chain

Stated responseLaunched an investigation to determine its full nature and scope

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov