The state’s Department of Highway Safety and Motor Vehicles now suggests even more people may be affected by a September data breach at the agency.
In a news release that went out around 5:30 p.m. on Friday, Oct. 16, the FLHSMV said it was issuing a “substitute notice” of the breach “because it may not have current mailing addresses for impacted customers who no longer hold a valid Florida driver license or identification card or who previously had a vehicle titled in Florida.”
Those who previously had a Florida driver license, Florida identification card or Florida title were asked to contact the department by emailing CustomerInquiry@flhsmv.gov and visiting FLHSMV.gov/DataBreach.
The state previously disclosed the breach by an unnamed “international cybercriminal organization” on Sept. 4 but still has not definitively disclosed whether driver license information was compromised and, if so, to what extent. The date range for the breach also has not been released.
On its website, the department does explain that a “criminal gained unauthorized access to a department system … using the credentials from an employee of a local Florida law enforcement agency, who improperly stored the credentials on an electronic device.” That agency was later identified as the Plant City Police Department.
The department said it “took immediate steps to contain the activity and secured its systems to prevent further unauthorized access.”
Investigators with the Florida Digital Service and Florida Department of Law Enforcement “determined the information potentially affected includes driver license and motor vehicle data, to include document images, and other personal information,” which “may have been accessed,” but there was no indication any “information (had) been misused.”
People who have Florida driver licenses or state ID cards will soon receive letters if they were “potentially impacted by the breach,” the Oct. 16 release said. “Additionally, to protect the identity of those impacted, we have partnered with Sontiq, Inc., a TransUnion company, to offer complimentary identity and credit monitoring services and $1 million identity theft insurance for 1 year.”
Who’s responsible for the data breach?
According to NBC News, ShinyHunters, a group that claimed responsibility for previous hacking attacks on other organizations, said it breached the “Florida DMV” and gave the department a deadline of Sept. 11 to negotiate a fee to not release the files it stole. But ShinyHunters deleted references to Florida after the FLHSMV published a statement.
ShinyHunters specializes in “large-scale data breaches and extortion,” according to the FBI. They “target major companies across tech, finance, and retail, often stealing millions of customer records at once,” says a public service announcement by the agency.
What should people with Florida driver licenses do now?
The department recommends the following:
-
Review account statements and credit reports for suspicious activity.
-
Monitor financial and online accounts.
-
Consider placing a fraud alert or security freeze with major credit bureaus.
-
Use Federal Trade Commission resources at www.identitytheft.gov/databreach.
A free credit report can be requested from each of the three nationwide consumer-reporting agencies by visiting www.AnnualCreditReport.com or by calling 1-877-322-8228.
Also, the three nationwide credit bureaus may be contacted at the following phone numbers:
Previously reported information by the USA TODAY Network’s Sarah Perkel was used in this story. Jim Rosica is a member of the USA TODAY Network – Florida Capital Bureau. Reach him atjrosica@tallahassee.comand follow him on X:@JimRosicaFL.
This article originally appeared on Tallahassee Democrat:Did Florida DMV data breach by ‘cybercriminals’ impact more people?
