ODOT sued over DMV hack that compromised 3.5 million residents’ information
PORTLAND, Ore. (KOIN) — Oregon has been hit with a lawsuit over the data breach that impacted 90% of the state’s licensed drivers and identification card holders last year.
On Friday, Caery Evangelist and Brian Els filed the complaint in Marion County Circuit Court “on behalf of themselves and all others similarly situated.”
$1.3B Powerball winner is Laos-born immigrant battling cancer
The plaintiffs accused the Oregon Department of Transportation of failing to protect about 3.5 million residents’ names, addresses, driver’s licenses, identification cards and last four digits of their social security numbers in the data breach.
The Driver and Motor Vehicle Services hack occurred around May 31, 2023. On that same day, Progress Software Corporation informed people on the company website that a breach in its MOVEit Transfer software “could lead to escalated privileges and potential unauthorized access to the environment.”
Oregon officials were alerted of the hack on June 1, but the state said it wasn’t aware that ODOT data was compromised until June 12. The agency announced the breach to the public later on June 15.
According to court documents, Oregon’s transportation department has failed to directly notify the affected residents, “which gives criminals a head start to use Plaintiffs’ and the Class’s [Personal Identifiable Information] for nefarious purposes.”
Late-season snow returns in a big way for Oregon, Washington
The complaint noted the profitability of this data, claiming that personal information is sometimes sold for up to $200 on the dark web.
The plaintiffs also said ODOT hasn’t revealed whether it will re-evaluate its relationship with Progress, or whether the software company has improved its security practices to prevent further data breaches.
Documents allege that Evangelist has dedicated about 45 hours to “addressing the fallout of the breach,” and spent $65 on an annual membership for the American Automobile Association’s credit monitoring services.
PSU library occupation now ‘criminal behavior,’ not ‘free speech,’ city officials say
She and Els are suing the state over negligence, breach of implied contract, breach of fiduciary duty and declaratory judgment. The class action suit requests at least $10 million on behalf of the Oregonians impacted last year.
ODOT spokesperson David House declined to comment on the case due to the pending litigation.
For the latest news, weather, sports, and streaming video, head to KOIN.com.
