Data breach impacts 3.5M Oregon ID, driver's license holders

Capi Lynn, Salem Statesman Journal
Updated ·2 min read
The Oregon Driver & Motor Vehicle Services office on Commercial Street SE.
The Oregon Driver & Motor Vehicle Services office on Commercial Street SE.

The Oregon Department of Transportation is among many organizations affected by a data breach inflicted by a global hack of the data transfer software MOVEit Transfer, according to a bulletin the agency sent out Thursday.

It said it discovered the breach Monday. The ODOT data impacted includes personal information for approximately 3.5 million holders of Oregon IDs or driver’s licenses.

While much of this information is available broadly, some of it is sensitive personal information. ODOT has notified law enforcement.

How did it happen?

ODOT has used MOVEit Transfer, a file-sharing tool created and managed by Progress Software Corp that allows organizations to transfer data between business partners and customers, since 2015. On June 1, the Cybersecurity and Infrastructure Security Agency announced PSC had released a security advisory for MOVEit Transfer and that the software had a vulnerability that could allow an attacker to "take over an affected system."

ODOT said it moved immediately to secure its systems and is confident they are now working safely.

It worked closely with state cyber security services and engaged a third-party security specialist for analysis, identifying multiple files shared via MOVEit Transfer that were accessed by unauthorized actors before receiving the security alert.

Whose data was breached?

ODOT said it cannot determine whose data was breached. Individuals with an active Oregon ID or driver's license should assume information related to that ID is part of this breach.

ODOT recommends anyone who may have been impacted monitor their credit reporters for suspicious activity.

What should you do now?

If you think you may have been affected, here's what you should do now:

You can request a free copy of your credit report every 12 months from each of the three consumer credit reporting companies. A credit report can provide information about those who have received your credit history. Request a report at annualcreditreport.com or by calling 1-877-322-8228.

Check credit reports for transactions or accounts that you do not recognize.

If you see anything suspicious, call the number listed on the credit report or visit the Federal Trade Commission's website on identity theft at consumer.gov/idtheft/. You can also ask the credit monitoring agencies to freeze your credit files.

This article originally appeared on Salem Statesman Journal: Data breach impacts 3.5M Oregon ID, driver's license holders