8 ms·

Geico data breach exposed customers’ driver’s license numbers

141 points by PretzelFisch 5y ago

ripply 5y ago
Some states driver's license numbers are deterministically computed with your name, date of birth and gender. If you live in one of those states and your data is already out there (through a previous breach) then your driver's license number is already public knowledge to hackers. According to an online calculator this applies to these states: Florida Illinois Maryland Michigan Minnesota (Prior to December 13, 2004 only) Nevada (Prior to January 1998 only) New Hampshire New Jersey New York (Prior to September 1992 only) Washington Wisconsin http://www.highprogrammer.com/alan/numbers/dl_us_shared.html http://www.highprogrammer.com/alan/numbers/dl_us_shared.html
- techsupporter 5y ago
  > Washington Not for too much longer for most people. ID cards issued on or after September, 2018 have a random code format instead of the generated one from before: https://custhelp.courts.wa.gov/ci/fattach/get/63481/0/filename/DLN+fact+sheet.pdf https://custhelp.courts.wa.gov/ci/fattach/get/63481/0/filena... All ID cards are being changed as they are renewed.
  - pmiller2 5y ago
    > All ID cards are being changed as they are renewed. Well, that's not going to cause anybody any issues.
- foolfoolz 5y ago
  > to hackers to everyone
- andrewmunsell 5y ago
  Back in college in Washington, I had a presentation to give in a class about privacy. To illustrate how very little of it we really have, I essentially doxxed the professor in front of everyone (of course, with his permission-- he had final say on what was actually shown to the class in the presentation) and demonstrated how public most people have their social media settings set to and what information was actually in the public record. Apart from things like public Facebook photos and things like public mortgage records and salary info for public school professors, I used the fact the DL number was deterministic to make a really good (and apparently correct) guess as to what the number really was. The professor was a really good sport about it.
- SilasX 5y ago
  >Some states driver's license numbers are deterministically computed with your name, date of birth and gender. Hm, I thought that couldn't be possible: if that were true, the system would be hosed the moment two people are born that match on all three. (Insert "falsehoods programmers believe about ...") Reading through to the link, it claims that some states do have issues with collisions like that (but doesn't provide enough to confirm independently): >>Looking at this, may become clear that it is possible for two people with similar names to get the exact same driver's license number. ... This is solved with "overflow" numbers, a simple sequential number can be appended to each duplicate number to resolve the confusion. >>...Illinois may have overflow digits, but if they do the information is not on your driver's license. This means that if Joshua William Smith is wanted by police and his driver's license number is flagged as such, Jack Wayne Snoddy may be briefly detained while the police check their records to sort out the shared number. I have been told that Illinois state databases actually include a two or three digit number to distinguish between different people with the same license. One correspondent told me that their friend was pulled over for a minor traffic violation and was arrested as someone else. He sat in the police car for a while while they sorted it out. He and the other person had the exact same number; the other guy was a wanted man, but my correspondent's friend did not.
- downrightmike 5y ago
  Also, the info can just be bought as most DOTs will see it as a revenue source. This is how companies find you about you're car's extended warranty.
  - airstrike 5y ago
    I don't have a car and yet still get that same call daily...
1-6 5y ago
Here's yet another instance where a blockchain could possibly solve the identity crisis of Americans.
- 2OEH8eoCRo0 5y ago
  Nah. I think that companies need to verify identities better. All information about me is probably out there in some form but there is still only one "me". Verify "me" better. Companies who are tricked into doing things with stolen credentials should be held accountable.
- eloff 5y ago
  Or you know, a centralized database. The problem is not that your SSN can be leaked, the problem is that it shouldn't be trusted in the first place. How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? And the court protects the bank? The problem here is the banks are being dumb, and rather than letting them suffer the consequences of that stupidity - the court makes it my problem. The legal system has seriously failed Americans here.
  - adolph 5y ago
    How would a "centralized database" solve "a bank can give a loan to anyone claiming to have my name and SSN?"
    - eloff 5y ago
      How does a blockchain solve it in a way that a centralized db does not? The choice of db does nothing to address the underlying problems. Which was my point.
    - idiotsecant 5y ago
      In pretty much the same way that a decentralized database like a blockchain would. You interact with the centralized database to permit the transaction requested by the loan distributor, probably via 2FA. The only difference in the schemes is whether you need to trust the centralized database or not. Most people would much rather trust a large institution than have responsibility for managing their key.
foobiter 5y ago
at this point i have very little data that hasn’t been exposed from various leaks and honestly it makes me feel a little helpless - I’ve had my drivers license number, phone numbers, unhashed passwords, personal health info, health insurance, credit card numbers, my social security number, home address, security questions... and more! all leaked/hacked. All I’ve gotten for this poor data handling is a few years of credit monitoring.
villgax 5y ago
Same has happened with MobiKwik in India & seemingly no action whatsoever has happened
christophilus 5y ago
Hopefully Geico has cyber insurance. If it’s insured by Berkshire, that’d be a tad recursive.
- thablackbull 5y ago
  Internal retrocession is a normal practice in insurance companies. The larger entity can pool money and absorb losses better.
  - christophilus 5y ago
    Berkshire really doesn't think that way, though. Their operations are largely distinct and don't really inter-communicate or plan. Fairly recently, one of their businesses sustained a large loss, and the casualty insurer paid out a handsome sum, so the business actually came out ahead. But the downside was that the insurer was one of Berkshire's subsidiaries. This was evidently unplanned and unknown ahead of time at the top level, but shows the decentralized structure of Berkshire is not just in name only.
gumby 5y ago
Note that these days if you go into one of many bars, pick up certain prescriptions, or buy alcohol at a supermarket, your DL is electronically scanned and all the info is read from the mag stripe or optical code from the back. The justification is that this prevents the checker (check out person, bouncer etc) from violating the law, protecting the business and the employee. The companies that sell sell the "age verifier" scanners collect all the scanned info, rather than merely verifying age. The big pharmacies and big supermarkets collect it all for marketing (in the pharmacy case it's also used for government pharmaceutical surveillance, in particular for the DEA). I've long been appalled that DLs contain anything more than required to drive (a field biometric like a photo, expiry date, class of service, and a confidential identifier so it can be checked by a cop for revocation). But that cat would be impossible to stuff back into the bag.
adolph 5y ago
In a data breach notification to impacted individuals, the company reveals that, between January 21 and March 1, 2021, using customer information acquired elsewhere, fraudsters managed to gain unauthorized access to driver’s license numbers by abusing the online sales system on Geico’s website. [0] 0. https://www.securityweek.com/car-insurance-company-geico-discloses-data-breach https://www.securityweek.com/car-insurance-company-geico-dis... It took them 6 weeks to report to CA AG: Organization Name Date(s) of Breach Reported Date Government Employees Insurance Company 01/21/2021, 03/01/2021 04/15/2021 https://oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=Government+Employees+Insurance+Company&field_sb24_breach_date_value%5Bmin%5D%5Bdate%5D=&field_sb24_breach_date_value%5Bmax%5D%5Bdate%5D= https://oag.ca.gov/privacy/databreach/list?field_sb24_org_na...
ppetty 5y ago
> We recently determined that between January 21, 2021 and March 1, 2021, fraudsters used information about you – which they acquired elsewhere – to obtain unauthorized access to your driver’s license number through the online sales system on our website. I wish there was some additional clarification around what "online sales system” is? Is that the system I use to buy insurance? Or is that the system Geico uses to sell my information (which, aside from breaches, might be the other way 3rd party access is gained to my personal information)?
- kevinpet 5y ago
  You can start a quote, but down the info the they already had, and it will check their internal systems and say "oh, is this you?"
cschneid 5y ago
The underlying problem seems to be that companies confuse identification with authentication. A drivers license number is a unique ID. The physical card with security features and a photo is the authentication that it belongs to me, holding it. Same thing with social security numbers. That can be treated as an identifier, so the bank can talk about an individual. But not as authentication and authorization to open new accounts. Data breaches would be so much less scary if banks and similar didn't keep screwing this up.
- dheera 5y ago
  They also sent me unsolicited junk mail at a new address and I don't know how they got that address. As such I would never use Geico for violating my privacy. I will only use companies that DON'T try to extract my personal info without me giving it to them explicitly. This only doubly confirms that they suck at privacy.
  - pxeboot 5y ago
    If you submit a change of address to the USPS, they sell that data to marketing companies. One workaround is to submit a 'temporary' address change for 6 months at a time instead.
    - dheera 5y ago
      I don't submit change of address to USPS for this reason. I hate the USPS with a passion for doing that to people.
      - bashinator 5y ago
        Hate the politicians who cut USPS' funding to such an extent that this is necessary.
        mistrial9 5y ago
        USPS wasted huge money and the Union demands even bigger pensions, while USPS is losing market to commercial carriers at the same time in the open market.. no one is clean in that fight
tibiahurried 5y ago
Something is fundamentally wrong if a driver license number can pose an identity security threat.
- myself248 5y ago
  Lots is fundamentally wrong. Have you been paying attention?
client4 5y ago
Hah Geico's internal claim system is a giant (internal) FTP dump of scans connected to a web front end. The FTP has endless scanns of claims checks, etc, including DL numbers. Maybe they should change their dev environment SQL passwords from SA.
- edoceo 5y ago
  haha, first time I see MSSQL(6.x) ask the admin for the credentials and he tells me, "sa" and the password. so I type in "ese" (friend) and then we had a few minutes of confusion / frustration.
killvung 5y ago
I really hate how organization nowaday just blatantly ask you for sensitive information then did an oopsie by breaching them out.
sulmahabd 5y ago
good luck

141 points by PretzelFisch 5y ago

Some states driver's license numbers are deterministically computed with your name, date of birth and gender. If you live in one of those states and your data is already out there (through a previous breach) then your driver's license number is already public knowledge to hackers. According to an online calculator this applies to these states: Florida Illinois Maryland Michigan Minnesota (Prior to December 13, 2004 only) Nevada (Prior to January 1998 only) New Hampshire New Jersey New York (Prior to September 1992 only) Washington Wisconsin http://www.highprogrammer.com/alan/numbers/dl_us_shared.html http://www.highprogrammer.com/alan/numbers/dl_us_shared.html

techsupporter 5y ago
> Washington Not for too much longer for most people. ID cards issued on or after September, 2018 have a random code format instead of the generated one from before: https://custhelp.courts.wa.gov/ci/fattach/get/63481/0/filename/DLN+fact+sheet.pdf https://custhelp.courts.wa.gov/ci/fattach/get/63481/0/filena... All ID cards are being changed as they are renewed.
- pmiller2 5y ago
  > All ID cards are being changed as they are renewed. Well, that's not going to cause anybody any issues.
foolfoolz 5y ago
> to hackers to everyone
andrewmunsell 5y ago
Back in college in Washington, I had a presentation to give in a class about privacy. To illustrate how very little of it we really have, I essentially doxxed the professor in front of everyone (of course, with his permission-- he had final say on what was actually shown to the class in the presentation) and demonstrated how public most people have their social media settings set to and what information was actually in the public record. Apart from things like public Facebook photos and things like public mortgage records and salary info for public school professors, I used the fact the DL number was deterministic to make a really good (and apparently correct) guess as to what the number really was. The professor was a really good sport about it.
SilasX 5y ago
>Some states driver's license numbers are deterministically computed with your name, date of birth and gender. Hm, I thought that couldn't be possible: if that were true, the system would be hosed the moment two people are born that match on all three. (Insert "falsehoods programmers believe about ...") Reading through to the link, it claims that some states do have issues with collisions like that (but doesn't provide enough to confirm independently): >>Looking at this, may become clear that it is possible for two people with similar names to get the exact same driver's license number. ... This is solved with "overflow" numbers, a simple sequential number can be appended to each duplicate number to resolve the confusion. >>...Illinois may have overflow digits, but if they do the information is not on your driver's license. This means that if Joshua William Smith is wanted by police and his driver's license number is flagged as such, Jack Wayne Snoddy may be briefly detained while the police check their records to sort out the shared number. I have been told that Illinois state databases actually include a two or three digit number to distinguish between different people with the same license. One correspondent told me that their friend was pulled over for a minor traffic violation and was arrested as someone else. He sat in the police car for a while while they sorted it out. He and the other person had the exact same number; the other guy was a wanted man, but my correspondent's friend did not.
downrightmike 5y ago
Also, the info can just be bought as most DOTs will see it as a revenue source. This is how companies find you about you're car's extended warranty.
- airstrike 5y ago
  I don't have a car and yet still get that same call daily...

1-6 5y ago

Here's yet another instance where a blockchain could possibly solve the identity crisis of Americans.

2OEH8eoCRo0 5y ago
Nah. I think that companies need to verify identities better. All information about me is probably out there in some form but there is still only one "me". Verify "me" better. Companies who are tricked into doing things with stolen credentials should be held accountable.
eloff 5y ago
Or you know, a centralized database. The problem is not that your SSN can be leaked, the problem is that it shouldn't be trusted in the first place. How is it a thing that a bank can give a loan to anyone claiming to have my name and SSN, without verifying that, and then hold me legally responsible for their lack of judgment? And the court protects the bank? The problem here is the banks are being dumb, and rather than letting them suffer the consequences of that stupidity - the court makes it my problem. The legal system has seriously failed Americans here.
- adolph 5y ago
  How would a "centralized database" solve "a bank can give a loan to anyone claiming to have my name and SSN?"
  - eloff 5y ago
    How does a blockchain solve it in a way that a centralized db does not? The choice of db does nothing to address the underlying problems. Which was my point.
  - idiotsecant 5y ago
    In pretty much the same way that a decentralized database like a blockchain would. You interact with the centralized database to permit the transaction requested by the loan distributor, probably via 2FA. The only difference in the schemes is whether you need to trust the centralized database or not. Most people would much rather trust a large institution than have responsibility for managing their key.

foobiter 5y ago

at this point i have very little data that hasn’t been exposed from various leaks and honestly it makes me feel a little helpless - I’ve had my drivers license number, phone numbers, unhashed passwords, personal health info, health insurance, credit card numbers, my social security number, home address, security questions... and more! all leaked/hacked. All I’ve gotten for this poor data handling is a few years of credit monitoring.

villgax 5y ago

Same has happened with MobiKwik in India & seemingly no action whatsoever has happened

christophilus 5y ago

Hopefully Geico has cyber insurance. If it’s insured by Berkshire, that’d be a tad recursive.

thablackbull 5y ago
Internal retrocession is a normal practice in insurance companies. The larger entity can pool money and absorb losses better.
- christophilus 5y ago
  Berkshire really doesn't think that way, though. Their operations are largely distinct and don't really inter-communicate or plan. Fairly recently, one of their businesses sustained a large loss, and the casualty insurer paid out a handsome sum, so the business actually came out ahead. But the downside was that the insurer was one of Berkshire's subsidiaries. This was evidently unplanned and unknown ahead of time at the top level, but shows the decentralized structure of Berkshire is not just in name only.

gumby 5y ago

Note that these days if you go into one of many bars, pick up certain prescriptions, or buy alcohol at a supermarket, your DL is electronically scanned and all the info is read from the mag stripe or optical code from the back. The justification is that this prevents the checker (check out person, bouncer etc) from violating the law, protecting the business and the employee. The companies that sell sell the "age verifier" scanners collect all the scanned info, rather than merely verifying age. The big pharmacies and big supermarkets collect it all for marketing (in the pharmacy case it's also used for government pharmaceutical surveillance, in particular for the DEA). I've long been appalled that DLs contain anything more than required to drive (a field biometric like a photo, expiry date, class of service, and a confidential identifier so it can be checked by a cop for revocation). But that cat would be impossible to stuff back into the bag.

adolph 5y ago

In a data breach notification to impacted individuals, the company reveals that, between January 21 and March 1, 2021, using customer information acquired elsewhere, fraudsters managed to gain unauthorized access to driver’s license numbers by abusing the online sales system on Geico’s website. [0] 0. https://www.securityweek.com/car-insurance-company-geico-discloses-data-breach https://www.securityweek.com/car-insurance-company-geico-dis... It took them 6 weeks to report to CA AG: Organization Name Date(s) of Breach Reported Date Government Employees Insurance Company 01/21/2021, 03/01/2021 04/15/2021 https://oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=Government+Employees+Insurance+Company&field_sb24_breach_date_value%5Bmin%5D%5Bdate%5D=&field_sb24_breach_date_value%5Bmax%5D%5Bdate%5D= https://oag.ca.gov/privacy/databreach/list?field_sb24_org_na...

ppetty 5y ago

> We recently determined that between January 21, 2021 and March 1, 2021, fraudsters used information about you – which they acquired elsewhere – to obtain unauthorized access to your driver’s license number through the online sales system on our website. I wish there was some additional clarification around what "online sales system” is? Is that the system I use to buy insurance? Or is that the system Geico uses to sell my information (which, aside from breaches, might be the other way 3rd party access is gained to my personal information)?

kevinpet 5y ago
You can start a quote, but down the info the they already had, and it will check their internal systems and say "oh, is this you?"

cschneid 5y ago

The underlying problem seems to be that companies confuse identification with authentication. A drivers license number is a unique ID. The physical card with security features and a photo is the authentication that it belongs to me, holding it. Same thing with social security numbers. That can be treated as an identifier, so the bank can talk about an individual. But not as authentication and authorization to open new accounts. Data breaches would be so much less scary if banks and similar didn't keep screwing this up.

dheera 5y ago
They also sent me unsolicited junk mail at a new address and I don't know how they got that address. As such I would never use Geico for violating my privacy. I will only use companies that DON'T try to extract my personal info without me giving it to them explicitly. This only doubly confirms that they suck at privacy.
- pxeboot 5y ago
  If you submit a change of address to the USPS, they sell that data to marketing companies. One workaround is to submit a 'temporary' address change for 6 months at a time instead.
  - dheera 5y ago
    I don't submit change of address to USPS for this reason. I hate the USPS with a passion for doing that to people.
    - bashinator 5y ago
      Hate the politicians who cut USPS' funding to such an extent that this is necessary.
      - mistrial9 5y ago
        USPS wasted huge money and the Union demands even bigger pensions, while USPS is losing market to commercial carriers at the same time in the open market.. no one is clean in that fight

tibiahurried 5y ago

Something is fundamentally wrong if a driver license number can pose an identity security threat.

myself248 5y ago
Lots is fundamentally wrong. Have you been paying attention?

client4 5y ago

Hah Geico's internal claim system is a giant (internal) FTP dump of scans connected to a web front end. The FTP has endless scanns of claims checks, etc, including DL numbers. Maybe they should change their dev environment SQL passwords from SA.

edoceo 5y ago
haha, first time I see MSSQL(6.x) ask the admin for the credentials and he tells me, "sa" and the password. so I type in "ese" (friend) and then we had a few minutes of confusion / frustration.

killvung 5y ago

I really hate how organization nowaday just blatantly ask you for sensitive information then did an oopsie by breaching them out.

sulmahabd 5y ago

good luck