Breach Year
2018 to 2019
Breach Type
Government Payment Software
TPRM Lesson
A vendor breach can replay across dozens of local governments.
What was the Click2Gov Municipal Payment Software Breach breach?
The Click2Gov breach was a 2018 to 2019 series of intrusions into a self-service municipal payment platform made by Superion (later CentralSquare), in which payment-card skimming code was implanted at more than 50 US city government portals, exposing residents' card and payment data.
Click2Gov is the case that showed one vendor breach can replay across dozens of local governments.
Residents paying utility bills or parking fines on their city website had no idea a single upstream vendor's software was compromised in city after city.
It became one of the longest-running government payment breaches in US history.
Click2Gov is a self-service payment platform used by US municipalities for utility, tax and parking payments.
2017 to 2018. First wave of Click2Gov breaches reported at multiple US cities.
June 2018. Superion issued patches and worked with affected cities.
2019. Second wave of intrusions hit additional municipalities using the patched software.
Total. 50+ US cities affected, hundreds of thousands of payment cards exposed.
The incidents drove federal guidance on securing municipal payment platforms and PCI review of government vendors.
Patching without rebuild left cities exposed a second time. The attacker's foothold survived the patch.
A. Identity and Access. Strict admin controls on payment portals.
B. SaaS and API Integrations. Segregate payment APIs.
C. Software Supply Chain. Track municipal software vendors.
D. File Transfer and Data Exchange. Tokenise cardholder data at capture.
E. Data Protection. PCI DSS scope reduction.
F. Vendor Incident Response. Coordinate with peer cities.
G. Fourth-Party Risk. Review vendor hosting and processing partners.
H. Board and Executive Reporting. Council-level oversight of critical vendors.
"One vendor's vulnerability becomes fifty cities' breach."
A US municipal self-service payment platform.
The vendor's software was compromised, not individual city systems.
More than 50 US municipalities across 2017 to 2019.
Payment card data and personal details of residents.
Superion, later CentralSquare Technologies.
Full rebuild after compromise, PCI scope reduction and skimmer monitoring.
Shared government software creates shared breaches.
Yes, class actions were filed against multiple cities.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification