On the afternoon of Feb. 11, 2021, the City of Bainbridge Island was made aware of a potential security/data incident related to its vendor, Automatic Funds Transfer Services, Inc (AFTS), that possibly exposed customers’ information. The City contracts with AFTS to handle water and sewer billing, including debit/credit card payments, and Business & Occupation (B&O) tax return mailing, processing, and receipt and deposit of paper check payments.
The AFTS servers were encrypted by ransomware sometime between the evening of Feb. 3 and the morning of Feb. 4, 2021. There is no direct threat to the City’s network as a result of this incident.
AFTS has hired a forensic company to address the ransomware attack and is attempting to retrieve all of its information, and has reported the ransomware attack and potential breach of customer information to the local police and FBI.
The information stored in the AFTS databases is limited to data necessary to fulfill utility billing and payment processing. The incident only affects City utility customers who pay their utility bills using the AFTS debit/credit card online or phone-in portals.
Customers who pay their utility bills by mailing a paper check, using the drop box outside City Hall or using their online banking bill-pay/ACH functions are not affected.
Potentially breached information from the AFTS database may have included the following information: utility bill account, customer identification number, name, address, and billing amounts. The databases do not contain any social security numbers, birth dates, driver’s license numbers, or any other Personally Identifiable Information (PII). The databases do not store and retain any credit card information.
Customers using the AFTS debit/credit card online or phone-in portals are encouraged to monitor their bank account for unusual activity and should report anything suspicious to their bank immediately.
The City has established a temporary online payment portal for utility customers through our alternative credit/debit card vendor, PayGov. At this time, the City continues to pay all credit/debit card fees for our customers. No customer will be charged convenience fees using this portal. This portal can be found at our utility payment website at bainbridgewa.gov/211. Alternatively, customers can mail a check to the City at 280 Madison Ave. N., Bainbridge Island, WA 98110. They can also use the City’s payment drop box outside City Hall near the accessible parking.
Business and Occupation (B&O) Taxes
For businesses filing their B&O tax return, the incident may affect customers who already filed their returns for reporting years 2019 and 2020, and paid their taxes with paper check payments.
Potentially breached information from the AFTS database may have included the information filed on the Annual Business & Occupation tax return, including the following information: business name, UBI number, name, address, and gross receipts. For businesses that paid their B&O tax by mailing paper checks (which include bank account and routing information), scanned copies of the paper checks are stored on the AFTS servers, and are also a potential for breach.
It is unknown at this time whether any information has been illicitly extricated from the AFTS network. The databases do not contain any social security numbers, birth dates, driver’s license numbers, or any other Personally Identifiable Information (PII). The databases do not contain any credit card information.
Businesses paying their B&O taxes with a paper check are encouraged to monitor their bank account for unusual activity and report anything suspicious to their bank immediately.
Customers who need to file and pay B&O taxes with the City can mail their return and check to the City at 280 Madison Ave. N., Bainbridge Island, WA 98110. They can also use the City’s payment drop box outside City Hall near the accessible parking. Alternatively, they can call the front desk at 206-842-7633 during business hours to make a payment over the phone and then either mail their return or leave it in the drop box.
The City of Bainbridge Island takes its role of safeguarding personal information very seriously. We continue to discuss additional measures that we as a municipality can adopt to ensure the highest level of security for personal information. For questions, please contact the City of Bainbridge Island at 206-842-7633.