HackingEnergy & UtilitiesGovernmentUtilitiesSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

City of Indio/Indio Water Authority

bd_e87aef691b9d3cf0 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Oct 12, 2018

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for City of Indio/Indio Water Authority →

City of Indio/Indio Water Authority reported unauthorized access to its third-party payment vendor, Click2Gov, affecting customers who made online water bill payments between January 1, 2017, and August 13, 2018. Exposed data included names, payment card numbers, expiration dates, and security codes. The vendor system was shut down, and a forensic investigation was launched.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2017

Begins

Oct 12, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: City of Indio/Indio Water Authority
norm: city of indio indio water authority
Domain: indiowater.org

Name: City of Indio/Indio Water Authority
norm: city of indio indio water authority
Domain: indiowater.org
Industry: Energy & UtilitiesllmGovernmentllm

Discovered: —
Breach occurred: Jan 1, 2017 – Aug 13, 2018
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Click2Gov
Initial access: supply_chain

During the incident: Shutting down the Click2Gov online water bill payment system
Initiating an expanded security review with our software vendor
Engaged a third-party forensic firm
Changes made: Enhancing our existing security protocols
Re-educating our vendors on the importance of protecting personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-140696
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 12, 2018
Raw hash: cc6e40c375f3a2ebfbdbbd64d760c9965ec6bc1d14573457f377385a486c0bd5

Reporting entityCity of Indio/Indio Water Authority

Victim entityCity of Indio/Indio Water Authority

IncidentThird-Party / Supply Chain

Stated responseShutting down the Click2Gov online water bill payment system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov