AccidentalGovernmentGovernmentMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

City of Naperville

bd_82bed30f3203af7f · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 28, 2025

Filed

Jul 14, 2025

To disclose

7 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for City of Naperville →

The City of Naperville, IL, notified the NH Attorney General that on May 28, 2025, it discovered liquor and tobacco license application records were publicly viewable via its online portal. The exposed data included names and driver's license numbers for approximately 1 NH resident. No SSNs were involved. The city disabled access, engaged cybersecurity professionals, and began notifying residents on July 10, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 47 days

May 28, 2025

Discovered

Jul 14, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_d16ac6687d2228792025-07-10 · +4dCandidate

Name: City of Naperville
norm: city of naperville

Name: City of Naperville
norm: city of naperville
Industry: Governmentllm

Discovered: May 28, 2025
Materiality determined: —
Notification sent: Jul 10, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified Attorney General John Formella

During the incident: Disabled access to the affected records
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Providing the affected residents with mail notification
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGJul 10 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/city-naperville-illinois-20250714.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2025
Raw hash: 9778b7fa31cf9bc3395601058ff3be32df9bb2b4c79a3599de4e957806c4bdf3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCity of Naperville

Victim entityCity of Naperville

Incidentdiscovered May 28, 2025

Stated responseDisabled access to the affected records

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov