Second Wave of Click2Gov Breaches Hits United States

guest · Sep 19, 2019

Two years later, hackers are still breaching local government payment portals
New 20,000 batch of payment card details found on the dark web and traced back to new Click2Gov hacks
September 19, 2019
https://www.zdnet.com/article/two-y...l-breaching-local-government-payment-portals/

Two years after hackers first started targeting local government payment portals, attacks are still going on, with eight cities having had their Click2Gov payment portals compromised in the last month alone, security researchers from Gemini Advisory have revealed in a report shared with ZDNet today.

These new hacks have allowed hackers to get their hands on over 20,000 payment card details belonging to US citizens, which are now being traded on the dark web, the cyber-security firm said.
US CITIES NOTIFIED
"Gemini attempted to reach out to several of these eight towns about the second wave of breaches; while most did not respond, those that did confirm a breach in their Click2Gov utility payment portals," the company said today in its report.
Everyone who paid taxes or bills on the Click2Gov self-service portals of the eight aforementioned cities are now advised to review payment card logs and request new cards from their banks.
Click to expand...

Gemini: Second Wave of Click2Gov Breaches Hits United States

guest · Sep 25, 2019

Palm Bay Officials Warn Residents of Utilities Portal Data Breach
September 24, 2019
https://www.mynews13.com/fl/orlando...arn-residents-of-utilities-portal-data-breach

Palm Bay officials are advising customers who pay their utilities online to make sure no fraudulent charges have been made it said after software used by the city was the target of a cyberattack.

The software, Click2Gov, is used by the city to accept utility payments. Palm Bay Community Information Coordinator Christina Born said CentralSquare, the company that manages Click2Gov, notified the city about the breach.
Palm Bay says it’s uncertain how many of their 8,000 customers who pay their utility bills online were affected by the breach.

Born said that as a precaution, the city created a new server while CentralSquare contacted the customers’ credit companies about potential fraudulent charges.
CentralSquare acknowledged to Spectrum News 13 that "a small number of customers have reported unauthorized access."
Click to expand...

guest · Sep 25, 2019

Pocatello residents report fraud after city system hacked
September 25, 2019
https://www.seattletimes.com/seattl...idents-report-fraud-after-city-system-hacked/

Several Pocatello residents say they’ve had unauthorized funds taken from their bank accounts after the city’s billing system was hacked.

The Idaho State Journal reports Pocatello police say several people who pay their municipal utility bills online with a debit or credit card have reported losses ranging from $30 to thousands of dollars. Pocatello city spokesman Logan McDougall says the city is working with its billing system vendor, Click2Gov, to investigate the matter.
Police Sgt. Brian McClure says police discovered the security breach when they noticed similar unauthorized payments from California while investigating some fraud cases.
Click to expand...

guest · Oct 6, 2019

City of Bakersfield discovers cyber security breach
October 4, 2019
https://bakersfieldnow.com/news/local/city-of-bakersfield-discovers-cyber-security-breach

The City of Bakersfield recently discovered a cyber security breach that may affect certain users of a third-party system used by the City to process certain online payments.

The city uses a third-party vendor, Click2Gov with CentralSquare Technologies for certain online payments.
The city received report of fraudulent activity that was detected on payment cards used through the Click2Gov online payment portal.
According to the city, the information entered through the Click2Gov online payment system on the City’s website includes name, address, email address, payment card number, expiration date, and card security code (CVV).
Click to expand...

guest · Oct 20, 2019

Port Orange Suspends Online Payment System to Investigate Possible Data Breach
October 18, 2019
https://www.mynews13.com/fl/orlando...-stops-online-payments-due-to-possible-breach

In a press release, city officials said the company that develops its payment system for utilities billing and taxes, Click2Gov, informed them they wanted to investigate “an unconfirmed software issue that may have resulted in vulnerabilities.”

Port Orange officials said they suspended this system at 11 a.m. Friday as a precaution while a cybersecurity firm investigates the possible breach.
The city said the systems it’s implemented to detect security breaches have not alerted officials to any “significant suspicious activity.”
Click to expand...

guest · Nov 1, 2019

Residents' Debit and Credit Cards Charged Hundreds of Dollars Through Cyber Attack on WAPA Payments Vendor
October 29, 2019
https://viconsortium.com/breaking-n...-customers-to-utilize-other-forms-of-payment/

The credit and debit cards of multiple Virgin Islands residents tied to their WAPA account were compromised recently, with two residents — one whose card was charged $363 for soccer tickets in France, and another whose U.S. bank blocked multiple transaction attempts — telling the Consortium of the occurrences Tuesday.

But in a release issued Tuesday night, WAPA advised its customers who pay their electrical and water bills online to ensure that “no questionable or fraudulent charges have been made on their credit or debit card accounts.”
WAPA revealed that the third-party vendor used by the authority to process credit and debit card payments was indeed the target of a cyberattack. The authority reminded residents of its other payment options as it continues to monitor the situation.

The payments system, named Click2Gov, was targeted by hackers who managed to compromise the system.
Click to expand...

guest · Nov 7, 2019

City of Norman online utility, permit payments temporarily disabled through Nov. 12
November 6, 2019
https://oklahoman.com/article/56461...-payments-temporarily-disabled-through-nov-12

All online payments for city of Norman utility services and permitting fees are suspended through Tuesday while the city makes an emergency transfer to a new payment processor.

The city was made aware of a potential security event involving Click2Gov, a third-party payment software system that processes some payments on behalf of the city. As a precaution, the city has taken down the Click2Gov payment servers and is in the process of implementing a new online payment solution through Paymentus. The new software is anticipated to be online by Tuesday.
The City of Norman is now working with CentralSquare, the parent company of Click2Gov, and other third-party experts to determine the scope of the security event.
Click to expand...

guest · Nov 14, 2019

Check your account - City of San Angelo investigating water billing security breach
November 13, 2019
https://eu.gosanangelo.com/story/ne...illing-has-second-security-breach/4179667002/

The City of San Angelo is investigating a security breach with the city's online water billing system after fears customer's credit card information may have been stolen.

"Some water customers may have noticed irregularities with their credit and debit card accounts after recently paying their monthly statement through the City’s online payment system," according to a news release issued Wednesday.
This latest breach is not the first time San Angelo residents have had to closely monitor their accounts. San Angelo resident's credit card information from the city's online water billing services was compromised in August 2018.
Click to expand...

City of San Angelo Click2Gov Municipal Services

Welcome to the City of San Angelo Click2Gov Municipal Services.
One-time payments are temporarily disabled until we transition to our new payment system.
Click to expand...

guest · Nov 19, 2019

College Station stops online utility payments while investigating data breach
November 18, 2019
https://www.kbtx.com/content/news/C...hile-investigating-data-breach-565091582.html

COLLEGE STATION, Tex. (KBTX) - The city of College Station is warning utility customers about a potential data breach.

The city said in a release they were recently informed about a potential data security issue with Click2Gov, a third-party system used to process payments online.
The city says they immediately launched an investigation, with the assistance of third-party experts, to determine the nature and scope of the security issue. They working with independent investigators and federal law enforcement to determine the scope of the event.
Click to expand...

guest · Nov 21, 2019

Questions loom after Dothan online payment processor hacked
November 19, 2019
https://www.wtvy.com/content/news/D...ers-online-payment-data-hacked-565175012.html

A data breach that compromised personal credit and debit card information entrusted to the city of Dothan raises questions about security measures of a third party processor.

“It has come to the City of Dothan’s attention that CentralSquare, the third-party processor of online utility payments, via their Click2Gov application, has been compromised via a recent cyber attack,” the city said in a statement.
Click2Gov, a large company that specializes in processing payments for government operations, has a history of data breaches.

In its statement, Dothan did not specify when it became aware of the breach. City spokesperson Vincent Vincent, who issued the news release, said he is attempting to obtain that information.
Several people have told WTVY that they used the Dothan online portal during the breach dates and, since, their credit and debit cards have been fraudulently used.
Click to expand...

Scope of Dothan Utilities’ customer information breach a bit more defined

While an exact number of Dothan Utilities online customers affected by a recent third-party security breach remains unknown, officials defined the impact a bit more Wednesday.
Click to expand...

guest · Nov 27, 2019

City of Dothan to hire attorneys in credit card data breach
November 27, 2019
https://www.wtvy.com/wrgx/content/n...eys-in-credit-card-data-breach-565542511.html

Dothan commissioners will likely hire attorneys to represent the city in a data breach that potentially affected several thousand of its utilities customers.

“A resolution will be presented to the Commissioners regarding an authorization for engaging the law firm of Mullen Coughlin LLC. to represent the City of Dothan,” spokesperson Vincent Vincent said in a news release Wednesday.
Central Square, that operates online payment portal Click2Gov, first acknowledged to the city that a breach likely occurred between August and October of this year, according to Dothan IT Director Jack Mason.

However, Central Square has since told Mason it cannot confirm that breach despite claims by numerous customers that they have been victimized.
The city has cyber insurance that would cover losses incurred by the city. The law firm of Mullen Coughlin LLC could also represent Dothan if the situation with Central Square becomes adversarial.

“This is a fluid situation and as new information becomes available, the City of Dothan will provide timely updates,” Vincent said.
Click to expand...

guest · Dec 5, 2019

About 3,000 Fort Worth water customers may have had info stolen in data breach
December 5, 2019
https://www.star-telegram.com/news/local/fort-worth/article238073889.html

About 3,000 customers of the Fort Worth Water Department may have had had their information stolen due to a data breach, a department spokeswoman said.

Those impacted would have made a one-time payment for Fort Worth water with a credit card between Aug. 27 and Oct. 23, spokeswoman Mary Gugliuzza said. The data that may be affected includes cardholder’s name, credit card billing address, credit card number, card type, credit card security code (CVV) and card expiration date.
Gugliuzza said the number of people impacted is a relatively small number. Fort Worth Water Department has about 263,000 water accounts.

CentralSquare, the vendor for the software Click2Gov that powers the department’s payment system, determined a breach occurred near the end of October or the beginning of November.
Earlier this week, the city sent letters to those whose data may have been stolen.
Click to expand...

guest · Dec 6, 2019

CVWD Responds to Data Breach
Cucamonga Valley Water District discloses Click2Gov breach
December 4, 2019
https://www.cvwdwater.com/CivicAlerts.aspx?AID=238

Cucamonga Valley Water District (CVWD) was recently informed of a data breach of the Click2Gov web portal used by CVWD customers for one-time credit card payments. CVWD values its customers and respects the privacy of their information, which is why, as a precautionary measure, we are proactively letting affected customers know about a data security incident that may have involved their personal information.

Between August 26, 2019, and October 14, 2019, a server that is used to accept one-time credit card payments from customers was breached allowing unauthorized access. This server is maintained and operated by an outside vendor of CVWD, Central Square.
This breach happened with an outside vendor, Central Square, which CVWD uses for customer payments. The relationship with this vendor and the vendor’s protocols are being re-evaluated by CVWD.
Click to expand...

guest · Dec 12, 2019

Waco: Online water payment portal breached, card data possibly captured
December 11, 2019
https://www.kwtx.com/content/news/W...ed-card-data-possibly-captured-566090001.html

WACO, Texas (KWTX) Waco’s online water payment portal Click2Gov was breached and payment cards entered between Aug. 30 and Oct. 14 may have been captured by a piece of malicious code inserted by hackers, the city said Wednesday.

"Unfortunately, this is something that happens in the credit card world," said Larry Holze, spokesman for the City of Waco.
The city is reviewing security policies and procedures and working with the FBI in an ongoing criminal investigation.

"The only information compromised would be the credit card information, the city does not keep credit card information, we do not keep any personal data, social security numbers, things like that," said Holze.
Holze says the 4-5 weeks of exposure happened during a temporal building period.
Click to expand...

guest · Dec 13, 2019

City of Odessa notifies residents of Click2Gov breach
December 12, 2019
https://www.keepodessabeautiful.org/Home/Components/News/News/9919/742

We have learned of a data security incident that occurred between August 27, 2019 and October 14, 2019 that involved some of our customers' credit/debit card information. The City of Odessa utilizes a third-party software product called Click2Gov to provide our customers with the ability to pay utility bills online via the Internet.

The breach only affected users of the online Click2Gov system who made one-time (not recurring) payments for utility bills. Any payments made in person, via the phone system, via E-Check or to any other city systems were not impacted.
The City of Odessa takes protection of our data systems very seriously and constantly updates all our systems so that risks to our customer data can be minimized.
Letters will be sent to our customers that we know performed one-time payments through Click2Gov during the time frame stated above.
Click to expand...

guest · Dec 17, 2019

Another Click2Gov victim is revealed in Texas
Sugar Land payment system data breach among a wave of Click2Gov attacks
December 16, 2019
https://www.chron.com/neighborhood/...yment-system-data-breach-among-a-14909537.php

The City of Sugar Land joined dozens of other cities that learned that Click2Gov, the online payment system used by the city, experienced a data breach involving residents making one-time credit card payments where the citizen manually typed in their credit card information to the online payment system. Similar data breaches have affected other cities across the state and nationwide.

“So far, we know that customers who used recurring credit card payments are not impacted unless they entered new credit card information. Those customers who paid by phone or in person are not at risk.”
City officials say the data breach remains the focus of an ongoing comprehensive investigation including all payment options and any affected customers will be notified following the investigation’s conclusion. The city is already in the process of initiating a new payment system in 2020, and more detail will be shared as the schedule is confirmed.
Click to expand...

guest · Dec 18, 2019

Marietta utility customer data found on dark web after third-party security breach
December 17, 2019
https://www.mdjonline.com/news/mari...cle_a233488c-212a-11ea-bc41-ef628c149a23.html

About 8,800 Marietta utility customers may have had their credit card information compromised after a third-party software vendor reported a security breach.

Central Square Technologies, which processes payments such as electric, water and sanitation for the city, reported that Marietta was one of over 30 cities that may have been affected by the breach.
Tax payments were not impacted.
Customers who manually entered credit card payments on the city’s website using Click2Gov between Aug. 26 and Oct. 26 may have been affected.

“The transaction on the dark web had six fields of information on it, it was the credit card number, the first name, the last name, the address, the city, the state and the ZIP code,” he said. “And there is a strong linkage between that data with other customer data. ... The FBI is assuming that all of that data was related to the Click2Gov. So there was no direct linkage, but they believe that’s where the linkage is. They have not verified that yet.”
Click to expand...

guest · Dec 26, 2019

mood said: ↑

College Station stops online utility payments while investigating data breach
November 18, 2019
https://www.kbtx.com/content/news/C...hile-investigating-data-breach-565091582.html
Click to expand...

CSU working to find alternate vendor after data breach
December 20, 2019
https://www.kbtx.com/content/news/C...rnate-vendor-after-data-breach-566378991.html

College Station Utilities said it was looking for a new way customers could pay their bills online.

In November, the utility company announced a data breach in its online payment system. In a release sent Friday, officials said city staff continues to work with forensic investigators to determine the nature and scope of the event. Once completed, CSU will notify potentially affected College Station Utilities customers.
Officials also said they are expediting the search for a new online payment vendor.

The release said while cybersecurity has been and continues to be, a top priority for the City of College Station, even stronger requirements of third-party vendors are being implemented to protect the city’s technology infrastructure.
Click to expand...

guest · Dec 31, 2019

Hack affecting Aurora agency may have stolen personal data
December 31, 2019
https://www.thedenverchannel.com/ne...g-aurora-agency-may-have-stolen-personal-data

Some Aurora residents may have had personal information compromised by a hacker when making water payments to the city.

Sentinel Colorado reports that residents who made payments between Aug. 30 and Oct. 14 through the Click2Gov system may be affected.
The water department said Monday that someone not associated with the city modified computer code used in Click2Gov software. The modification aimed to capture names, billing addresses and credit card numbers.
Click to expand...

Aurora Water announces data breach

Personal information of some Aurora Water customers, such as names, card numbers and expiration dates, may have been compromised through a data breach, according to the city's water department.

Last month, Aurora Water launched a new payment system called Paymentus and is in the process of fully transitioning to that new system, which was not affected and can be used to make online payments.
A dedicated webpage has been set up to assist affected customers and to provide updates about the breach.
Click to expand...

guest · Jan 8, 2020

The City of Bend discloses Click2Gov breach
Data Security Incident (01/07/2020)

The City of Bend was recently informed that a potential data security incident may have compromised the payment card information of some City utility customers who made one-time utility bill payments or enrolled in auto pay using a credit or debit card between August 30, 2019 and October 14, 2019.

The data that may have been affected could include the cardholder’s name, card billing address, card number, card type, card security code and card expiration date. Other personal information such as Social Security numbers or government-issued identification numbers were not affected by this incident. The City of Bend does not collect that information for utility billing purposes.
The City learned of the potential security incident from CentralSquare, the third-party vendor that manages and operates the City’s online utility payment portal, known as Click2Gov.
Click to expand...

guest · Feb 13, 2020

Hackers compromise financial information for Carson City residents who pay water bill online
February 2, 2020
https://carsonnow.org/story/02/11/2...rson-city-residents-who-pay-water-bill-online

According to a letter sent out to a group of residents who pay their water bill online in Carson City, their financial information was compromised due to a data breach, according to City Manager Nancy Paulson.
The incident "may have involved some personal information you provided to a Carson City vendor in connection with a utility payment," Paulson states in the letter.

Carson City received a report of a security vulnerability on their third-party vendor's online payment system, Click2Gov, which impacted individuals who legitimately used their website to make payments.
The city then launched an investigation, determining that an unauthorized code was inserted into the online payment system, developed by a third-party vendor called CentralSquare Technologies, according to Paulson. The code was designed to capture payment card data and other information between the dates of Aug. 1, 2019 and Sept. 12, 2019.

CentralSquare worked with Carson City to immediately remove the malicious code, said Paulson, and have partnered with an outside forensics firm that specializes in cybersecurity to prevent something similar from happening in the future.
Click to expand...

guest · Feb 18, 2020

Cities are fleeing payment platform Click2Gov after data-breach resurgence
February 18, 2020
https://statescoop.com/ux-user-experience-click2gov-data-breach-cities/

Over 2017 and 2018, dozens of small and midsize cities across the United States had to tell their residents that their personal data had potentially been included in data breaches linked to Click2Gov, a popular platform that many local governments use to process online payments for things like utilities, parking tickets and other fees that cities collect.

Local governments using Click2Gov — a number that was estimated to be as high as 6,000 — installed security patches, and the rash of breaches appeared to have subsided. But last August, the exposures started up again, with another group of cities, [...]
‘We rallied all our resources’
This time, researchers say, the fix might not be as simple as patching an application server.

“I think there may be issues with an Oracle product, but I don’t think that’s the sole cause,” said Inga Goddijn, the executive vice president of Risk Based Security, a cybersecurity consulting firm that studied the previous run of Click2Gov breaches.
One detail the recent breaches have in common is that they appear to affect customers who make one-time payments, but not people who enroll in automatic monthly billing.

“There was no confirmation on the scope or nature of it,” she said. “So we rallied all our resources, and at that point, we started our own investigation to really try and determine the nature and scope so we could take our own action.”
Click to expand...

While the actors behind the most recent wave of Click2Gov attacks haven’t been identified, the last round was indeed lucrative. According to threat intelligence firm Gemini Advisory, data collected in the 2017 and 2018 Click2Gov breaches fetched $1.9 million on the dark web.
Click to expand...

guest · Jul 4, 2020

Possible Click2Gov Security Breach Under Investigation
June 30, 2020
https://www.palmbayflorida.org/Home/Components/News/News/8513/

On Monday, June 29th, the City of Palm Bay learned of a possible security breach involving the Click2Gov online payment platform. The system is used by the Palm Bay Utilities Department and the City’s Building Division to process credit card payments. The City of Palm Bay Information Technology Department has taken the server that supports the Click2Gov service offline as a precaution.

The City of Palm Bay is actively monitoring the situation and is in communication with both Central Square, the parent company of Click2Gov, and Sylint. At this time, there is no confirmation of a security breach or that any credit card information may have been compromised.
Credit card payment processing will be temporarily unavailable for Building Division and Palm Bay Utilities Department customers.
Click to expand...

guest · Jul 16, 2020

mood said: ↑

Possible Click2Gov Security Breach Under Investigation June 30, 2020
Click to expand...

Click2Gov payment security investigation update
July 13, 2020
https://www.hometownnewsbrevard.com...cle_06a3b9e2-c512-11ea-9c8a-3b5eb0a4fa1c.html

City of Palm Bay leadership received an update from Central Square on the possible security breach involving the Click2Gov online payment platform used by the Palm Bay Utilities Department and the City's Building Division for credit card processing. Central Square has identified a security vulnerability within their system; however, they have been unable to find evidence that user data was accessed.

Considering the recent security issue within the Click2Gov platform, the City of Palm Bay has decided to move to a new online payment system. The new, cloud-based payment solution will offer enhanced account security and user-friendly features. The City is working diligently to expedite the set up and launch of the new system.
A temporary payment solution has been implemented to enable customers to make secure online credit card payments to the City's Building Division and the Utilities Department.
Click to expand...

guest · Oct 3, 2020

Data hack compromises Odessa residents’ personal information
October 2, 2020
https://www.cbs7.com/2020/10/02/data-hack-compromises-odessa-residents-personal-information/

The city of Odessa recently had a data breach involving its online payment web portal, and this isn’t the first time it’s happened.

The breach only affected users of the online Click2Gov system who made one-time payments for utility bills.
Odessa uses Click2Gov as third-party provider software that allows people to pay their utility bills online.

The data breach lasted from mid-April to late-June and is the second data breach on the system within the last year.
Click to expand...

Odessa isn’t the only city affected. Over the last four years, several data breaches have affected similarly sized cities such as College Station or Bend, OR. Both of those cities stopped using Click2Gov for their online payments.
Click to expand...

Log in or Sign up

Second Wave of Click2Gov Breaches Hits United States

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Second Wave of Click2Gov Breaches Hits United States

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches