October 9, 2026: The City of Oshkosh, Wisconsin told residents that unauthorised users had accessed account details for select utility customers through two third-party billing vendors, AquaHawk and InvoiceCloud. Names, email addresses, utility account numbers and invoice numbers were involved. Canonical record: city-of-oshkosh-utility-billing2026. Coverage of the city statement: WBAY.
This is a thin-sourcing post. The city’s own pages could not be loaded during our check, so the details rely on WBAY’s account of the city’s statement. The city has not said how many customers were affected, so there is no count in the catalog row.
What happened
- October 9, 2026: The city’s notice is dated this day. It says the city is addressing unauthorised access to utility billing information held by its two third-party vendors.
- Vendor action: InvoiceCloud disabled the compromised access key, preventing further access to customer information, according to the city’s statement.
- Customer notice: Affected customers were notified by email.
- October 26, 2026: WBAY reported the notice.
What was exposed
The city says the affected information includes account numbers, customer names, email addresses and invoice numbers. It also says Social Security numbers, driver’s licence or state ID numbers, financial account details, card numbers, security codes and passwords were not accessed. Those exclusions matter: the exposed fields are enough to write a convincing bill-themed message, but not enough to take over a bank account on their own.
Why the scope is limited to some customers
The city describes the access as affecting select utility customers, not every account the utility holds. A customer who has not been emailed is not confirmed as affected, but the city has not published a list or a number. The safest course is to treat any bill-related message with the same caution either way. If you want to know whether your account was among those notified, contact the billing office by the phone number or email shown on your bill.
How to recognise a bill scam
Bill-themed fraud usually shows one of three patterns. The first is a payment link that does not match the city’s usual address, or a request to pay in an unusual way. The second is urgency: a warning that service will be cut off within hours unless you act now. The third is a request for card details or a one-time code in a reply, which a billing office does not need to take a payment. If a message shows all three, delete it and pay through the route you already use.
If you already clicked a link
If you followed a payment link and entered details, contact your card issuer or bank at once, using the number on the back of the card or on its website, and ask them to watch for unusual activity. Change the password on the utility portal account and on any email account that shares it. If you entered a one-time code, do not share it again and treat the attempt as a scam.
Verified vs unverified
- Verified (city statement, as reported): the two vendors; the categories of information accessed; the categories not accessed; InvoiceCloud disabling the key; affected customers emailed; no action needed on utility accounts.
- Not disclosed: how many customers were affected, when the access began, how the access happened, and whether any other clients of the two vendors were involved.
Who is at risk
Oshkosh utility customers who pay through these billing platforms are the people most likely to be targeted. The main risk is a fake bill or payment notice that quotes a real account or invoice number and asks you to pay through a link.
What to do
- No action is needed on your utility account, according to the city. Staying alert is still worthwhile.
- Pay your bill only through the city’s official route, by typing the address yourself or using the phone number or email printed on your bill.
- Ignore payment links in unexpected emails or texts, even if they show your account number or invoice number. Those details are what the attackers hold.
- Check any payment change by calling the city’s billing office on a number you already have.
- Change the password on any utility portal account you use, if you reuse it elsewhere.
Context
Third-party billing vendors are a common weak point for local government, because a single vendor can hold records for many customers. The SBI leak in October showed the same sequence of personal details leaking first and impersonation calls following (see our SBI KYC breach post). For Oshkosh, the practical lesson is to treat any bill-related message as suspicious until you have checked it through a route you control.
The city has said it will post further updates as needed. Check the city’s utility billing pages by typing the address yourself, rather than following a link in a message, for any change to what it has published.
Sources
Related reading
- SBI KYC data breach: personal details leaked first, impersonation calls followed.