City of Bend

The City of Bend, operating as the municipal administration for Bend, Oregon, provides core local government services to its residents and businesses. A key component of its public-facing operations is the management of utility services, which includes an online payment portal enabling customers to make one-time payments or enroll in automatic payment plans. This digital infrastructure, essential for facilitating citizen transactions, was historically managed through a third-party vendor named Click2Gov. The city's role involves overseeing these contracted services to ensure reliable and secure access for its community.

In August 2019, the City of Bend experienced a significant cybersecurity incident specifically tied to its online utility payment system. Malicious code was inserted into the vendor's software, potentially compromising the payment card information—including names, billing addresses, card numbers, security codes, and expiration dates—of customers who used the portal during a defined period. The breach did not involve Social Security numbers, as that data was not collected by the system. Upon discovery, the city and its vendor acted to contain the incident by removing the malicious code and implementing enhanced security measures, with no ongoing risk identified post-remediation. The city demonstrated a structured response by notifying all potentially affected individuals, offering complimentary credit monitoring services, and collaborating with forensic investigators and law enforcement to fully assess the scope and origin of the compromise. This event underscored the city's reliance on third-party technology partners for critical citizen services and its commitment to transparency and mitigation following a security failure. Consequently, the city announced plans to transition to a new payment provider, indicating a strategic shift in its vendor management approach for this essential municipal function.