Who: Hanover County

What was affected: All credit card information entered into the Click2Gov system for utility and building inspection payments between approximately August 1, 2018, and January 9, 2019. This information includes customer names, credit card number, and expiration dates. Payments made over the phone and automatic withdrawals were not affected; only payments made online through the Click2Gov portal were compromised.

When it happened: August 1, 2018, and January 9, 2019

How it happened: On January 9, 2019, Gemini Advisory, a group that monitors internet websites for exposed credit card information, notified County staff that credit card information used to make online payments through Hanover’s Central Square Click2Gov system had been compromised. A vulnerability that the County was unaware of allowed this credit card information to be taken during transactions by unauthorized individuals.

Outcome: The County immediately validated the claim and isolated the Click2Gov system from public access to try to find what information had been compromised and whether the County’s system was still vulnerable. The County has been working with MS-ISAC and CERT, outside agencies that deal with information breaches, to complete a full forensic analysis of what occurred. The County is also working with the software company and has built a new Click2Gov server using different software than the program that was involved in the original breach.