In 2017 and 2018, hackers compromised systems running the Click2Gov self-service bill-payment portal in dozens of cities across the United States, a feat that compromised 300,000 payment cards and generated nearly $2 million of revenue. Now, Click2Gov systems have been hit by a second wave of attacks, dumping tens of thousands of records onto the dark web, researchers said on Thursday.

ARS TECHNICA This story originally appeared on Ars Technica, a trusted source for technology news, tech policy analysis, reviews, and more. Ars is owned by WIRED's parent company, Condé Nast.

The new round of attacks began in August and have so far hit systems in eight cities, six of which were compromised in the previous episode, researchers with security firm Gemini Advisory said in a post. Many of the hacked portals were running fully up-to-date systems, which raises questions about precisely how the attackers were able to breach them. Click2Gov is used by utilities, municipalities, and community-development organizations to pay bills and parking tickets as well as make other kinds of transactions.

“The second wave of Click2Gov breaches indicates that despite patched systems, the portal remains vulnerable,” Gemini Advisory researchers Stas Alforov and Christopher Thomas wrote. “It is thus incumbent upon organizations to regularly monitor their systems for potential compromises in addition to keeping up to date on patches.

So far, more than 20,000 records swept up in the new round of hacks have been offered for sale on online crime forums. While the breaches affect eight cities located in five states, payment cards belong to people in all 50 states have been compromised. Some of the card holders didn’t live in the cities that were affected but transacted with the breached portals, possibly because of past travels to those cities or because holders owned property there, the researchers said. The cities with hacked portals are:

Deerfield Beach, Florida

Palm Bay, Florida

Milton, Florida

Bakersfield, California

Coral Springs, Florida

Pocatello, Idaho

Broken Arrow, Oklahoma

Ames, Iowa

Those appearing in bold were hit for the first time.

Illustration: Gemini Advisories

Representatives with CentralSquare Technologies, the company that markets Click2Gov, wrote in a statement: