7 ms·
Major Louisiana DMV Hack
- kmoser 3y agoNo problem, just issue everybody a new birthdate, height, and eye color.
- lotsofpulp 3y agoOr the more common sense, cheaper, and easier approach of holding lenders liable for not doing their due diligence. “Identity theft” does not or should not exist as a thing. It is and always should have been fraud between a lender and the person(s) committing fraud, and prosecuted as such, with the business buying insurance if it wants to protect itself from losses to due to fraud.
- rickoooooo 3y agoOregon too. https://www.oregonlive.com/commuting/2023/06/massive-hack-of-oregon-dmv-system-puts-estimated-35-million-driver-license-and-id-card-info-at-risk-officials-say.html https://www.oregonlive.com/commuting/2023/06/massive-hack-of...
- buildbot 3y agoErrrr they used third party software that got hacked, yikes : “global hack of the data transfer software MOVEit Transfer”
- rickoooooo 3y agoLooks like a larger scale supply chain attack. https://www.nbcnews.com/tech/security/us-govenment-agencies-hacked-cyberattack-moveit-rcna89525 https://www.nbcnews.com/tech/security/us-govenment-agencies-...
- rng_civ 3y agoNope, just a classic SQL injection attack on software used by a lot of people...
- rickoooooo 3y agoThanks for the correction. Gonna have to look into that one. Very unfortunate.
- rng_civ 3y agoHere's the CISA announcement: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...
- buildbot 3y agoIt seems that Oregon and Louisiana were using a piece if “industry standard software” to “move large files” (extremely hard facepalm here) “global hack of the data transfer software MOVEit Transfer” Social security numbers were included! Also, how did the data leak if this statement from MOVEit is true: “ MOVEit provides secure collaboration and automated file transfers of sensitive data and advanced workflow automation capabilities without the need for scripting. Encryption and activity tracking enable compliance with regulations such as PCI, HIPAA and GDPR”
- Turing_Machine 3y agoNot just those two, from what I'm seeing. Apparently MOVEit is used by many government agencies, at all levels, as well as banks, universities, etc.
- manicdee 3y agoAt least this wasn't the "who has registered with porn sites" database.
- MengerSponge 3y agoIt's not clear, but what about former Louisiana residents? How long does the DMV keep those records?
- anticristi 3y agoScary stuff: > Individuals can freeze and unfreeze their credit for free, which stops others from opening new accounts and borrowing money in your name. > To prevent someone else from filing returns or receiving your federal tax refund, request an “Identity Protection Pin” from the Internal Revenue Service [...] This blows my mind. How can these things be allowed without proper authentication? I assume digital identity à la eIDAS, BankID or Freja is not a thing in the US?
- buildbot 3y agoNope, typically just a Name and Social Security Number (which we assume they have all leaked at this point) is enough.
- AnonMO 3y agoThey tried facial recognition but that was cancelled to oblivion cancel
- sofixa 3y ago> I assume digital identity à la eIDAS, BankID or Freja is not a thing in the US? There isn't even standardised non-digital identity on which to build, so no. It's funny how Americans will loudly proclaim Europe can't innovate and there's so much innovation in the US, yet they're practically in the dark ages in many areas - digital and offline identity, banking, insurance, healthcare, internet costs, tax filing etc. Fingers crossed the free market will come and innovate.