Social EngineeringGovernmentGovernmentPhishingEmployee Data InvolvedIdentity (basic)Government IDMediumResolved

West Boise Sewer District

bd_e9fa01abc72f435a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 3, 2023

Filed

Mar 17, 2023

To disclose

14 days

Affected

1state residents only

Confidence

66%

Full breach record for West Boise Sewer District →2 incidents on file

West Boise Sewer District notified the Idaho Attorney General of a phishing incident where an employee responded to a fraudulent email requesting direct deposit changes and inadvertently provided a resident's name and Social Security number. The District investigated, engaged forensic counsel, and notified the affected individual, offering two years of Experian credit monitoring. The investigation is complete.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 61 days

discovery → filing · 14 days

Jan 1, 2023

Begins

Mar 3, 2023

Discovered

Mar 17, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: West Boise Sewer District
norm: west boise sewer district

Name: West Boise Sewer District
norm: west boise sewer district
Industry: Governmentllm

Discovered: Mar 3, 2023
Breach occurred: Jan 1, 2023 – Mar 3, 2023
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2023
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: provided notice of this incident to the Office of Risk Management, ITS Chief Information Security Officer and ITS Chief Information Officer
Initial access: phishing_link

During the incident: Launched an internal investigation
Engaged legal counsel
Hired a nationally- recognized cyber security and digital forensics firm to assist with investigation
Providing written notice to the one (1) Idaho resident
Arranged for a review of its email system to ensure that there was no unusual activity
Enhanced its protocols for updating direct deposit account information
Provided notice of this incident to the Office of Risk Management, ITS Chief Information Security Officer and ITS Chief Information Officer
Changes made: Review of its email system to ensure that there was no unusual activity
Enhanced its protocols for updating direct deposit account information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2023/03/West-Boise-Sewer-District-3-17-2023.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2023
Raw hash: f6dbd91a1f95bbcbcd81a216fff0c79bbd32b9987126a312b1be54c56d3c574d

Reporting entityWest Boise Sewer District

Victim entityWest Boise Sewer District

Incidentdiscovered Mar 3, 2023

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov