HackingEnergy & UtilitiesUtilitiesVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Cucamonga Valley Water District (cvwdwater.com)

bd_927ac56cebf81df9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 6, 2019

Filed

Dec 4, 2019

To disclose

28 days

Affected

Not disclosed

Confidence

66%

Full breach record for Cucamonga Valley Water District (cvwdwater.com) →2 incidents on file

Cucamonga Valley Water District notified customers that its payment vendor, Click2Gov, was targeted by a cyberattack involving an unauthorized script in its web payment portal. The incident affected customers who paid bills online between August 26, 2019, and October 14, 2019. Exposed data included names, billing addresses, and credit card details. The vendor removed the script, launched a forensic investigation, and contacted the FBI. Credit monitoring was offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 72 days

discovery → filing · 28 days

Aug 26, 2019

Begins

Nov 6, 2019

Discovered

Dec 4, 2019

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Cucamonga Valley Water District (cvwdwater.com)
norm: cucamonga valley water district cvwdwatercom
Domain: cvwdwater.com

Name: Cucamonga Valley Water District (cvwdwater.com)
norm: cucamonga valley water district cvwdwatercom
Domain: cvwdwater.com
Industry: Energy & Utilitiesllm

Discovered: Nov 6, 2019
Breach occurred: Aug 26, 2019 – Oct 14, 2019
Undetected for: 72 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Contacted the Federal Bureau of Investigations
Third party: via Click2Gov
Initial access: exploit_public_facing

During the incident: Removed the unauthorized script from the code of the Click2Gov portal
Launched a forensic investigation with a leading cybersecurity firm
Contacted the Federal Bureau of Investigations
Offering a twelve-month subscription to a credit monitoring service offered through TransUnion
Changes made: Taken steps to make sure that this security breach cannot happen again
Closely monitoring their data security procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-184838
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2019
Raw hash: 2a10dd2d8140b2e5e5ada00c168bcce133c8389cd6a03255fecd9e69cc3a4454

Reporting entityCucamonga Valley Water District (cvwdwater.com)

Victim entityCucamonga Valley Water District (cvwdwater.com)

Incidentdiscovered Nov 6, 2019

Stated responseRemoved the unauthorized script from the code of the Click2Gov portal

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov