International Cybercriminal Organization Accessed Florida Driver License Data Through Stolen Law Enforcement Credentials
Driver license and motor vehicle data was accessed by a malicious actor on Sept. 4, the Department of Highway Safety and Motor Vehicles reported Friday. The department stated that an international cybercriminal organization used compromised credentials to breach the system. The breach happened because a local Florida law enforcement employee kept their login details on a digital device where they shouldn’t have been.
Investigation and Immediate Containment Actions Taken by State Agencies
The FLHSMV stated that immediate steps were taken to contain the activity and secure its systems following the breach. Swift safety protocols put in place by the agency involved cutting off unauthorized entry, updating passwords for affected accounts, hiring cybersecurity experts, and deploying extra protections. An investigation was conducted with the Florida Digital Service and the Florida Department of Law Enforcement.
If you have trouble accessing MyDMV Portal through the above link, please click here instead: https://t.co/H4QMDfxalr
Data Compromised and Notification Plans for Affected Florida Residents
Potential impacts from the security breach could encompass details such as driver licenses data, motor-vehicle information, document images, and other personal information. While the department stated that it has no evidence indicating that information has been misused, it intends to send letters to current driver license or identification card holders potentially affected. These letters will offer complimentary identity and credit monitoring services and $1 million identity theft insurance for 1 year. Potential victims can also confirm if their data was stolen by emailing FLHSMV at customerinquiry@flhsmv.gov.
Unanswered Questions Regarding the Delay in Public Notification
The Department of Highway Safety and Motor Vehicles reported the breach on a Friday, after the unauthorized access occurred on Sept. 4. It remains unclear why the department waited a month and a half to announce the incident to the public. Furthermore, the department did not state how many individual records were accessed during the breach.