Oregon’s DMV System Caught up in Global Hack, Millions at Risk of Identity Theft

In this photo illustration, the California Department of Motor Vehicles (DMV) logo appears on California driver's licenses in San Anselmo, Calif. on May 9, 2017. Justin Sullivan/Getty Images

Oregon’s Department of Motor Vehicles (DMV) system has been hacked, putting millions of people at risk for identity theft.

Oregon DMV confirmed Thursday that the agency was hacked two weeks ago.

An estimated 3.5 million driver’s licenses and identification card files were compromised.

DMV spokesperson Michelle Godfrey said the breach had extended to about 90 percent of the state’s driver’s license and ID card files.

She advised the public to monitor credit reports for signs of fraudulent activity.“We didn’t have any information about what data may have been affected at that time,” Godfrey said.

“It’s taken days of analysis” to determine that the hack compromised the state’s driver’s license and ID records.

Part of Global Hack

The hackers exploited a flaw in a popular file-transfer software called MOVEit by Massachusetts-based Progress Software.

The agency was among “many organizations” affected by the breach due to a “global hack of the data transfer software MOVEit Transfer,” the Department of Transportation said in a statement.

The hack hit numerous U.S. agencies, companies, and organizations.

Chief information officer Thomas Amato said the agency delayed informing the public out of security concerns and because “we have been trying to put in place things to prepare Oregonians for this announcement.”

“Sensitive personal information” on millions of driver’s licenses and ID card holders was compromised.

“I think for security purposes, we’re not going to discuss exactly what data points were potentially included in that file,” Amato said. “What we’re saying is if you have an Oregon driver’s license ID permit driver’s permit, you can assume that data associated with that credential has been compromised.”

Louisiana Affected

Authorities said the breach has also affected anyone with that documentation in Louisiana.

Casey Tingle, a senior in the Louisiana governor’s office, said Friday that more than 6 million records were compromised while noting that number is duplicative because some people have vehicle registrations and driver’s licenses.

The office of Louisiana Governor John Bel Edwards confirmed that there was no evidence suggesting that the compromised data from the Louisiana Office of Motor Vehicles were sold or released.

U.S. officials described the cyberattack as an opportunistic, financially motivated hack that has not caused disruptions to agency services.

“We can’t just rely on technical and security data related to vulnerable [software installations, but also business relationships—contracts, for example—to really understand how bad this is, and how bad it’s going to get,” Munish Walther-Puri, senior director of critical infrastructure at consultancy Exiger, told CNN.

On June 1, the Cybersecurity and Infrastructure Security Agency issued “a zero-day vulnerability alert” that said the software had a “vulnerability which could allow an attacker to ‘take over an affected system.”

In March, the Biden-Harris administration released the National Cybersecurity Strategy to secure and protect Americans from cyber-hackers.

In California, Governor Gavin Newsom issued a similar “roadmap”  protecting California’s database from getting breached.

“Hackers steal our time, money, and peace of mind. Protecting our data is among the most important things we can do to prevent disruption to our daily lives and economy,” Newsom said in a statement. “We must do more to safeguard the state’s critical infrastructure, intellectual property, and status as one of the world’s leading economies.”