City Water Payment System Breach Larger Than First Reported

SAN ANGELO, TX -- Credit card information for water customers who made payments in person and automatically online may have been breached in addition to those who made individual payments online. The vendor who processes card payments alerted the City today that the scope of the potential vulnerability has widened.

Previously, the vendor believed any compromise that may have occurred affected only online customers who make individual payments each month. Customers who pay by bank draft, by check or cash, or by phone have not been affected; payment by phone is a service provided by a separate vendor.

Online payments have been temporarily disabled. Payments may be made by calling 325-657-4323 or by bank draft. Payments can also be made by cash or check at City Hall Annex, 301 W. Beauregard Ave., from 8 a.m.-5 p.m. weekdays. A 24-hour dropbox is also available at that location.

“We apologize for the inconvenience this has caused customers,” Water Utilities Director Allison Strube said. “We are working with the vendor who processes our online payments to determine whether credit card information was vulnerable, the number of accounts that might have been impacted, and the time span over which that could have occurred.”

The City received a concern Friday that online water bill payments may have led to unauthorized charges on customers’ credit card accounts. The City immediately disabled the site, encouraged customers who had made online payments to monitor credit card accounts for unauthorized charges, and began working with the third-party vendor to install new software and a new server. Those actions are in keeping with state law, which demands that municipalities notify citizens and address such situations immediately and proactively.

The City’s vendor is still seeking to confirm whether credit card information was vulnerable and, if so, when. If the vendor finds that occurred, customers who made credit card payments during that period will be contacted by mail. In the meantime, customers are advised to watch their credit card accounts for illicit activity.

As soon as the City knows more about the situation, it will be shared on its Facebook and Twitter pages, on the City’s website and with the local news media.

Any vulnerability regarding credit card information would not have increased the amount of a monthly bill. Customers whose water accounts are paid automatically online will not have to re-enroll for that service, unless they use a different card. Late fees incurred while the online system was inactive will be addressed on a case-by-case basis by the Water Customer Service office, which can be contacted at 325-657-4323 or during business hours at City Hall Annex.

“While the risk of using a credit card – online and elsewhere – always exists, the City of San Angelo is dedicated to working with our vendors to ensure the most secure online experience possible for our citizens,” City Manager Daniel Valenzuela said. “Again, we apologize for the inconvenience this has caused.”