HackingGovernmentGovernmentVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

Board of Public Works City of Lewes

bd_d74b328c024d1f05 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 28, 2019

Filed

May 29, 2019

To disclose

≤1 day

Affected

Not disclosed

Confidence

66%

Full breach record for Board of Public Works City of Lewes →2 incidents on file

Board of Public Works City of Lewes notified customers on May 29, 2019, of a data breach discovered on May 28, 2019. A hacker exploited a software vulnerability in the utility's customer information system provider to copy customer data, including names, email addresses, credit/debit card numbers, and financial account credentials. The utility isolated the affected system, notified the vendor, and engaged with state and federal agencies. No actual misuse of information was known at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · ≤1 day / 1 days

May 28, 2019

Discovered

May 29, 2019

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Board of Public Works City of Lewes
norm: board of public works city of lewes

Name: Board of Public Works City of Lewes
norm: board of public works city of lewes
Industry: Governmentllm

Discovered: May 28, 2019
Materiality determined: —
Notification sent: May 29, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: notified by federal and state agenciesin contact with state and federal agencies regarding the incident
Initial access: exploit_public_facing

During the incident: Isolated the computer system in question
Began compiling information to notify all affected customers
Notified our software vendor
Actively working with said vendor to identify and secure the suspected breach
In contact with state and federal agencies regarding the incident
Changes made: Test and bring the system online
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2020/06/LewesBPW.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2019
Raw hash: 7ec0f866099c2779d26ce925ca13ee26b3d406e4c12409b106f65af189cf5531

Reporting entityBoard of Public Works City of Lewes

Victim entityBoard of Public Works City of Lewes

Incidentdiscovered May 28, 2019

Stated responseIsolated the computer system in question

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov