2026 City of Oshkosh (WI) — utility billing vendors AquaHawk and InvoiceCloud; account data exposed for select customers
Data compromised
Customer names, email addresses, utility account numbers and invoice numbers. The city says Social Security numbers, driver’s licence or state ID numbers, financial account details, card numbers, security codes and passwords were not accessed.
Technical writeup
The city’s notice is dated October 9, 2026; WBAY reported it on October 26. The number of affected customers has not been stated. The city says no action is needed on utility accounts and advises staying alert for phishing. The date above is the notice date, because the intrusion date is not published. The city’s own pages could not be loaded during this check, so the details rely on WBAY’s account of the city statement. companyConfirmed true.
Root cause
Unauthorised access through two third-party utility billing vendors, AquaHawk and InvoiceCloud. InvoiceCloud disabled the compromised access key. The city has not published the entry route or the date the access began.