Oregon AG Offers Guidance After Cyberattack

Attorney General Ellen Rosenblum released guidance following the recent Department of Motor Vehicles (DMV) security breach. This global cyberattack may affect 3.5 million Oregonian driver’s licenses and identification cards.

The state’s justice department data breach report indicates the cyberattack happened between May 28 and June 2, 2023, and the consumer notification occurred on June 16. The breach affected over 2,000 organizations using third-party transfer software. This includes 3,000 DMV files hacked while the agency sent data utilizing that software to partner agencies.

According to State Rep. Susan McLain (D-Dist. 29), the Legislature Joint Committee on Transportation Co-chair’s weekly newsletter to constituents: “The DMV attack is apparently one of [several] global cyberattacks; the same MOVEit-related […] attacks as seen in Illinois, Minnesota, with various federal agencies, and Johns Hopkins University.”

DMV administrator Amy Joyce said: “It could include things beyond what is printed on the card itself.” In addition, Oregonians with valid IDs or driver’s licenses should assume their personal information has been affected by the cyberattack.

AG Ellen Rosenblum’s Guidance to Affected Oregonians

On June 16, Rosenblum said: “Learning that personal information most Oregonians (82%) gave to their government has been exposed in a data breach is highly distressing.”

As a result, Oregon’s attorney general suggests individuals use the following recommendations from the Department of Justice:

1. “Order copies of your free credit reports and review them for inaccuracies.
2. Consider freezing your credit.
3. If you have been a victim of identity theft, place a one-year fraud alert on your credit reports.
4. If you receive notices from the Oregon Employment Department about benefits you’ve never applied for, contact them immediately: unemployment.oregon.gov and click “ID Theft” to fill out the ID Theft Reporting Form.
5. Set up a profile change alert if you use mobile or online banking tools.
6. If you have been a victim of identity theft, report it immediately. If you suspect a criminal has used your driver’s license information to steal your identity, report it online at IdentityTheft.gov.”

For more information about identity theft, visit the Oregon Department of Justice online at https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/identity-theft/ or call the state consumer hotline at 877-877-9392, between 8:30 a.m. and 4:30 p.m. PT, Monday through Friday.

MOVEit Software Vulnerable to Cyberattack

Furthermore, the DMV cyberattack happened before the DHS advised the Oregon Department of Transportation (ODOT) of a critical problem with Progress Software Corp.’s MOVEit security.

Axios author Sam Sabin published two reports about the software’s vulnerabilities. The first (June 2) discusses the second known problem, and the second (June 21) report covers the discovery of a third flaw increasing cyberattack incidences.

According to Sabin, “Roughly 2,500 instances of MOVEit file-transfer tool are believed to be running online.” Ransomware groups and cybercriminals organizations have favored these tools in recent years. Researchers indicate organizations using the tool are at risk if they do not properly patch their systems. If hackers exploit the vulnerability, they could steal or alter the content.

Progress Software Corp. has released patches that can be applied to resolve the MOVEit file-transfer tool’s three vulnerabilities.

Written by Cathy Milne-Ware

Sources:

Oregon Department of Justice Consumer Protection: ID Theft & Data Breaches
Pamplin Media Group: DMV data breach compromises 3.5 million Oregonians’ personal information; by Anna Kaminski
Oregon Capital Insider: Attorney general has recommendations for Oregonians following DMV data breach; by Peter Wong
Axios: Malicious hackers target vulnerable file-transfer tool; by Sam Sabin
Axios: Researchers uncover third flaw in MOVEit file-transfer tool; by Sam Sabin

Featured and Top Image Courtesy of Unsplash+
First Inset Image Courtesy of Office of Attorney General Oregon – Public Domain License
Second Inset Image Image by Markus Spiske Courtesy of Unsplash