5 ms·

"The breach of information was caused by Vertafore. The Texas Department of Motor Vehicles was not hacked and was not the cause of the breach." I appreciate th

"The breach of information was caused by Vertafore. The Texas Department of Motor Vehicles was not hacked and was not the cause of the breach." I appreciate that the Texas DMV wasn't the direct cause of this breach, but they can't completely pass the buck to Vertafore. At the very least, I would think they need to issue 28 million new licenses with new license numbers and invalidate the old ones. And, since this is likely to be an expensive and time consuming process, they should probably sue Vertafore to make them pay for it. And while they're at it, they should probably make sure that Vertafore is never allowed to access this data again. Realistically, none of this will happen, the compromised DL #s will remain valid in perpetuity (I just had someone tell me they moved out of Texas for 5 years and were issued the same DL # when they moved back), and Vertafore won't even be fined.

bdcravens 6y ago
I was in a similar boat, with a 6 year gap. I've had the same DL number my entire life.
tidepod12 6y ago
It's ridiculous that the DMV is passing the buck at all on this. The DMV are the originators of the data. It is their responsibility to make sure that any third party who has access to this data has the appropriate security in place to protect that data. This isn't some far-fetched premise, either. "Third Party Risk Management" is a basic part of pretty much every cyber security framework I can think of. It is even part of the NIST CSF, which every government entity in the US is supposed to be following. Vertafore's failure is the DMV's failure, and heads should roll at the DMV.
- cheschire 6y ago
  Should every company that relies on Equifax be blamed for that one as well?
  - njarboe 6y ago
    No. But every company that gives information to Equifax could and probably should be.
    - cheschire 6y ago
      Doesn't that just feel vindictive though? DMV can't afford the kind of external auditing that would've caught this. Not with their current budget. Setting aside taxes etc, what do you propose a public service organization should do in these situations other than trust a company to do what they're saying? edit: removed a statement distracting from the two questions.
      - deleted 6y ago
        [deleted]
      - yzmtf2008 6y ago
        Having better regulation and a bigger government? If the benefit outweighs the damage of data breach here, what's the argument against it?
        cheschire 6y ago
        Yeah it might be distracting from the two questions I did ask. I'll remove the statement because it seems to ruffle some political feathers. It wasn't intended politically, but rather to say the tax situation is a known quantity already which is why the second question asked to set that aside before answering.
      - tremon 6y ago
        DMV can't afford the kind of external auditing that would've caught this Usually, the prevailing wisdom of HN will respond to such a statement with "if you can't afford to do it properly, you shouldn't be doing it at all".
      - clort 6y ago
        Can't afford the auditing with the current budget? So you have to consider if you really care about the privacy that auditing would bring. If you do, then increase the budget.
- vertis 6y ago
  It's also a little ridiculous that this information is still valuable from a fraud perspective. It's completely possible to run as SmartId/Card system (similar to the Estonian national id / e-residency). So long as just knowing some of these details has value like getting fraudulent credit cards the problem will exist, and criminals will find ways of accessing the data. Now granted, stuff like the home address is always going to be valuable, but less so if its not as useful for identity theft.
  - clankyclanker 6y ago
    > It's completely possible to run as SmartId/Card system (similar to the Estonian national id / e-residency). That’s not necessarily a good example of doing it well. Unless something changed since I last looked, after the Estonian certs were all found vulnerable, allowing impersonation and forged signatures on official government documents, the government refused to reissue new certs to citizens. In other words, they were effectively in the same place as Texas.
    - foolmeonce 6y ago
      I don't think that is accurate. The rollout took time but ultimately disabled certificates that weren't updated. It also didn't lead to major attacks as weak keys still needed to each be exploited. Sending 3rd parties perfect copies of private data of your citizens to run a credit scheme is a different place.
- rurban 6y ago
  Exactly. Who on earth could expect that they just copy the entire database to a minor insurance company? The data will always be incomplete, out of date and insecure. Not providing a proper query service to all the insurances is a major fault, and the responsible people should be fired immediately.
- deleted 6y ago
  [deleted]
- deleted 6y ago
  [deleted]
- tremon 6y ago
  Basically, this is the structure that the GDPR mandates: the data controller (entity that processes data on behalf of the customer) is liable for data security breaches, regardless of whether the breach occurred at themselves or a third-party data processor. Eventual fines will also be shared by them, and the ratio will depend on how diligent the controller was in selecting and auditing their data processor(s). Exactly because it's too easy to outsource your exposure risk along with your customers' data.
mkl95 6y ago
Passing the hot potato is incident management 101 for organizations processing personal data with an external service. This happens to public / state agencies of many countries every now and then. Many of these incidents seem to be caused by systems allowing weak passwords.
- throwaway201103 6y ago
  It is a big part of the reason that service providers and consultants exist and command the fees that they do. They are implicitly signing up to be the fall guy if the project doesn't go well.
  - mkl95 6y ago
    Indeed. If your systems don't prevent users from setting "12345" as their password you deserve all the blame imo.
deleted 6y ago
[deleted]
davchana 6y ago
> (I just had someone tell me they moved out of Texas for 5 years and were issued the same DL # when they moved... California too, one keeps the same number for whole life, all between ID, License, Commercial & anything in between. The only way to change it by religious objection to the number like 666 or 999 or such; or if somehow DMV issued same number to two persons; which has happened in past long ago.
edwhitesell 6y ago
My wife and left Texas in 2013, moved back about 18 months later in 2014. They told us we couldn't renew/update our licenses and had to get new ones (both would have not expired yet). When we recevied the "new" ones, the numbers and expiration dates were the same. Texas is by far the worst state I've lived in for getting your drivers license and vehicle registrations.

bdcravens 6y ago

I was in a similar boat, with a 6 year gap. I've had the same DL number my entire life.

tidepod12 6y ago

It's ridiculous that the DMV is passing the buck at all on this. The DMV are the originators of the data. It is their responsibility to make sure that any third party who has access to this data has the appropriate security in place to protect that data. This isn't some far-fetched premise, either. "Third Party Risk Management" is a basic part of pretty much every cyber security framework I can think of. It is even part of the NIST CSF, which every government entity in the US is supposed to be following. Vertafore's failure is the DMV's failure, and heads should roll at the DMV.

cheschire 6y ago
Should every company that relies on Equifax be blamed for that one as well?
- njarboe 6y ago
  No. But every company that gives information to Equifax could and probably should be.
  - cheschire 6y ago
    Doesn't that just feel vindictive though? DMV can't afford the kind of external auditing that would've caught this. Not with their current budget. Setting aside taxes etc, what do you propose a public service organization should do in these situations other than trust a company to do what they're saying? edit: removed a statement distracting from the two questions.
    - deleted 6y ago
      [deleted]
    - yzmtf2008 6y ago
      Having better regulation and a bigger government? If the benefit outweighs the damage of data breach here, what's the argument against it?
      - cheschire 6y ago
        Yeah it might be distracting from the two questions I did ask. I'll remove the statement because it seems to ruffle some political feathers. It wasn't intended politically, but rather to say the tax situation is a known quantity already which is why the second question asked to set that aside before answering.
    - tremon 6y ago
      DMV can't afford the kind of external auditing that would've caught this Usually, the prevailing wisdom of HN will respond to such a statement with "if you can't afford to do it properly, you shouldn't be doing it at all".
    - clort 6y ago
      Can't afford the auditing with the current budget? So you have to consider if you really care about the privacy that auditing would bring. If you do, then increase the budget.
vertis 6y ago
It's also a little ridiculous that this information is still valuable from a fraud perspective. It's completely possible to run as SmartId/Card system (similar to the Estonian national id / e-residency). So long as just knowing some of these details has value like getting fraudulent credit cards the problem will exist, and criminals will find ways of accessing the data. Now granted, stuff like the home address is always going to be valuable, but less so if its not as useful for identity theft.
- clankyclanker 6y ago
  > It's completely possible to run as SmartId/Card system (similar to the Estonian national id / e-residency). That’s not necessarily a good example of doing it well. Unless something changed since I last looked, after the Estonian certs were all found vulnerable, allowing impersonation and forged signatures on official government documents, the government refused to reissue new certs to citizens. In other words, they were effectively in the same place as Texas.
  - foolmeonce 6y ago
    I don't think that is accurate. The rollout took time but ultimately disabled certificates that weren't updated. It also didn't lead to major attacks as weak keys still needed to each be exploited. Sending 3rd parties perfect copies of private data of your citizens to run a credit scheme is a different place.
rurban 6y ago
Exactly. Who on earth could expect that they just copy the entire database to a minor insurance company? The data will always be incomplete, out of date and insecure. Not providing a proper query service to all the insurances is a major fault, and the responsible people should be fired immediately.
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
tremon 6y ago
Basically, this is the structure that the GDPR mandates: the data controller (entity that processes data on behalf of the customer) is liable for data security breaches, regardless of whether the breach occurred at themselves or a third-party data processor. Eventual fines will also be shared by them, and the ratio will depend on how diligent the controller was in selecting and auditing their data processor(s). Exactly because it's too easy to outsource your exposure risk along with your customers' data.

mkl95 6y ago

Passing the hot potato is incident management 101 for organizations processing personal data with an external service. This happens to public / state agencies of many countries every now and then. Many of these incidents seem to be caused by systems allowing weak passwords.

throwaway201103 6y ago
It is a big part of the reason that service providers and consultants exist and command the fees that they do. They are implicitly signing up to be the fall guy if the project doesn't go well.
- mkl95 6y ago
  Indeed. If your systems don't prevent users from setting "12345" as their password you deserve all the blame imo.

deleted 6y ago

[deleted]

davchana 6y ago

> (I just had someone tell me they moved out of Texas for 5 years and were issued the same DL # when they moved... California too, one keeps the same number for whole life, all between ID, License, Commercial & anything in between. The only way to change it by religious objection to the number like 666 or 999 or such; or if somehow DMV issued same number to two persons; which has happened in past long ago.

edwhitesell 6y ago

My wife and left Texas in 2013, moved back about 18 months later in 2014. They told us we couldn't renew/update our licenses and had to get new ones (both would have not expired yet). When we recevied the "new" ones, the numbers and expiration dates were the same. Texas is by far the worst state I've lived in for getting your drivers license and vehicle registrations.