HackingGovernmentGovernmentStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedTargetedPIIFinancial accountFinancial credentialsMediumContained

The City of Sioux City, Iowa

bd_c4bffa1ffa9dec6c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 16, 2019

Filed

Feb 6, 2020

To disclose

7 weeks

Affected · nationwide

3,5631 in this filing

Linked

3 filings

Confidence

66%

Full breach record for The City of Sioux City, Iowa →

The City of Sioux City, Iowa, disclosed a data security incident involving its third-party payment portal, Click2Gov. Malicious code inserted into the site captured payment card information (name, address, card number, expiration, CVV) for 3,563 accounts between August 28 and September 18, 2019. The City discovered the issue on December 16, 2019, engaged forensic investigators, and replaced the payment vendor. Affected individuals were offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 110 days

discovery → filing · 7 weeks / 52 days

Aug 28, 2019

Begins

Dec 16, 2019

Discovered

Feb 6, 2020

Filed

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_81ea640f43c4d6862020-01-17 · +20dCandidate
Washington State AGbd_a84d9de7ba27168a2020-01-17 · +20dVerified

Name: The City of Sioux City, Iowa
norm: the city of sioux city iowa
Domain: sioux-city.org

Name: The City of Sioux City, Iowa
norm: the city of sioux city iowa
Domain: sioux-city.org
Industry: Governmentllm

Discovered: Dec 16, 2019
Breach occurred: Aug 28, 2019 – Sep 18, 2019
Undetected for: 110 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3,563state + nationwide
Data types: PIIFinancial accountFinancial credentials
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input CaptureT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Launched an investigation to determine its full nature and scope
Third-party forensic investigators were engaged
Worked with the third-party vendor responsible for the payment application to ensure the security of the Click2Gov website moving forward
Took steps to confirm and further strengthen the security of our systems
Engaged a different third-party vendor to process payments
Will work with law enforcement regarding any criminal investigation
Changes made: Engaged a different third-party vendor to process the City’s Parking Ticket System and Utility Billing System credit card payments
Strengthen the security of our systems, including our online utilities payment portal
Continue to review our security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGJan 17 · first

Washington State AGJan 17 · first

South Carolina State AG+20d · this page

Pattern: first filing Jan 17 (MT), last Feb 6 (SC) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2020/SiouxCity.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2020
Raw hash: fafc58224b513209a6fedde0eb1c4106c6ddf4d951b699f34f0443d0185a37d3

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThe City of Sioux City, Iowa

Victim entityThe City of Sioux City, Iowa

Incidentdiscovered Dec 16, 2019

Stated responseLaunched an investigation to determine its full nature and scope

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov