The Oregon Department of Transportation learned on 1 June 2023 that it was among the organisations reached through the MOVEit Transfer vulnerability filed at 23-0601. It disclosed exposure affecting around 3.5 million people holding Oregon permits, driver licences and identification cards.
Louisiana’s Office of Motor Vehicles disclosed exposure affecting at least 6 million records. Reported fields include names, addresses, social security numbers, dates of birth, height, eye colour, licence numbers and vehicle registration information. Louisiana stated it had found no evidence the data was sold, used, shared or released.
There Is No Opting Out Of A Licence
Every other consumer file in this database involves someone who chose a company. Here the population is everyone in two states who needed to drive legally, and the agency holding the data is the only one that can issue it.
The corpus files the same absence of choice at 26-0628 for Texas licence holders and 26-0411 for a public sector estate. Where the data controller is the state, the standard consumer remedies — switch provider, close the account, withhold consent — do not exist even in principle.
The Field List Is An Identity Kit
Name, address, date of birth, social security number and licence number in one record is not an inconvenience. It is the set of fields other institutions use to establish that somebody is who they say they are.
The corpus records the same aggravating combination at 23-0316 for Latitude Financial and 26-0726 for AssuranceAmerica, and the same irreversibility: a licence number can be reissued, slowly, but a date of birth cannot.
No Evidence Of Use Is Not Evidence Of Safety
Louisiana’s statement that it found no evidence the data had been sold or used is worth recording precisely and reading carefully. It is a statement about what the state could observe.
Stolen identity data has no expiry, and the corpus argues at 23-0227 that ciphertext or records sitting unused are a timing question rather than a closed one. This file is recorded as closed because the intrusion is; the exposure is not the kind of thing that closes.
Built on the Oregon Department of Transportation’s own published breach page and on contemporaneous reporting of both states’ disclosures. The 1 June awareness date, the approximately 3.5 million Oregon figure, the at-least 6 million Louisiana figure, the field lists and Louisiana’s statement about evidence of use are the agencies’ own as published and reported. The combined figure is the sum of two separately disclosed populations and may double-count anyone holding credentials in both states; no de-duplicated total is asserted. The underlying campaign and its attribution to Cl0p rest on the CISA/FBI advisory cited at 23-0601. Graded high. Corrections: corrections@forensicpost.com.
- MOVEit Data Breach — Oregon Driver & Motor Vehicle ServicesOregon Department of Transportation
- Millions of Oregon, Louisiana state IDs stolen in MOVEit breachBleepingComputer