US State of Oregon DMV ID Data Breach

The Oregon Driver and Motor Vehicles Division (DMV) of the Oregon Department of Transportation (ODOT) recently confirmed that an estimated 3.5 million driving licences and ID cards were compromised when the agency was hacked.

Attorney General Ellen Rosenblum said: ‘Learning that personal information most Oregonians gave to their government has been exposed in a data breach is highly distressing. While the state works to identify who was impacted and what data was exposed, please follow these recommendations to stay safe’.

The statement goes on to make recommendations that those with an Oregon driving licence or ID card should consider freezing credit accounts and set up a profile change alert if using mobile or online banking tools.

The notice on the Department of Justice (DoJ) website posted a consumer protection news alert that cybercriminals copied information from driving licences and identification card holders, as part of the global MOVEit Transfer attack.

As the de facto form of identification in many US states, driving licences contain a lot of information about the individual, including birth date, home address and even height, weight, and eye colour. Scammers can use some of this information to steal identity and apply for credit cards, loans, and unemployment benefits in the document holder’s name.

The notice goes on to say that, even if thieves have already opened accounts in the bearer’s name, they can take action to stop future damage. It doesn’t address the issue of damages incurred up to the time that the document holder notifies the authority.

The advice goes on, rather optimistically, to say that ‘you should notify the banks or financial institutions behind the credit card or loan accounts opened fraudulently in your name. Explain to these institutions that you did not apply for these accounts or loans and that you are a victim of identity theft. The financial institutions will close these accounts.

‘If you act quickly, you likely will not be responsible for charges made on fraudulent credit cards you didn’t apply for, and you may not have to pay back loans that thieves took out in your name.’