The big DMV data breach is still worth your attention
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Aïda Amer/Axios
It's been two weeks since the Oregon Department of Transportation announced that personal data from all Oregon driver's license, permit and ID holders had been accessed by hackers. But it's not too late to protect yourself from further harm.
Why it matters: While it's still unclear exactly what hackers walked away with, it can take a while for stolen data to get used. Meanwhile, it takes just 20 minutes to do the first step — check your credit.
Catch up quick: On June 1, ODOT learned from the Cybersecurity and Infrastructure Security Agency — the federal agency tasked with reducing cybersecurity threats — that hackers got into the agency's files through a vulnerability in a file transfer system. This was one day after the software company involved announced the problem.
- On June 12, ODOT realized personal identifying information in DMV files were among data hackers accessed, and warned the public three days later.
How it works: James E. Lee, the chief operating officer of the Identity Theft Resource Center, told Axios that the going black market rate for license information is up to $150.
- Checking your credit report and freezing your credit can stop thieves from using your information for fraudulent purposes, like applying for government benefits or opening a bank account in your name.
- "They don't want to do anything that's difficult," Lee said. "They're all about volume and automation."
What we did: Emily here. I hopped on the one website where you can review all three big credit agency reports at once and downloaded what TransUnion, Equifax and Experian had on me.
- Luckily nothing on there looked unfamiliar or suspicious.
- Freezing your credit can also be done online, is free and takes effect immediately.
Of note: Previously, free credit reports were available only once a year. But because of the rise in fraud during the pandemic, for the rest of this year you can check your report once a week.
Threat level: Driver's license data can be crossed with other public and hacked information to help thieves. For example, a number of Oregonians were affected by previous hacks into EyeMed and Legacy Health systems. But not everyone whose data was exposed will have problems, says Allan Liska, a threat intelligence analyst at Recorded Future.
- "There is a very high chance that most people reading this won't be victimized by this data dump," Liska told Axios. "The problem is that the few who are could be really victimized."
The Oregon intrigue: While personal DMV data was involved, a bulk of the information accessed was related to ODOT internal operations, according to spokesperson Michelle Godfrey.
- It could take weeks "to really understand the full extent of the breach," Godfrey told Axios.
The bottom line: You may never be directly impacted. But it's easy to take at least a first step toward stopping it.
- Keep an eye out for lawsuits, which sometimes have followed similar breaches.