Why a stolen DMV file weakened identity checks at agencies that were never breached

The week

Just before this week, Louisiana’s Office of Motor Vehicles and Oregon’s DMV disclosed that license and ID holder records had been taken through Progress Software’s MOVEit Transfer, a managed file transfer product. Louisiana said it believed everyone with a state-issued license, ID or vehicle registration was likely affected. Oregon put its exposure at about 3.5 million license and ID holders. The Cl0p extortion group had been exploiting a SQL injection flaw (CVE-2023-34362) that Progress disclosed on May 31, and CISA had confirmed that several federal agencies were also affected. During the week, more public-sector disclosures followed, including from CalPERS, California’s public pension system, whose retiree data was exposed through a vendor’s MOVEit server. Both states urged residents to watch for fraud and consider freezing their credit.

Earlier in this series we looked at how MOVEit reached most of its victims through vendors. This article takes a narrower question that matters to every state and local agency with an online service. Once a whole population’s license records are in criminal hands, what happens to the verification checks that assumed those records were private? We take it in four parts: where license data was serving as a secret, why a wholesale leak breaks that use for everyone, what should replace it, and what residents need to be told.

Where license data served as a secret

License data does two jobs in government, and they are easy to confuse. The first is identification: a license number links a person to a record. The second, less visible, is authentication. Many online services ask a resident to type a license number, issue date or document discriminator to prove they are the person they claim to be.

That second use is everywhere. Unemployment insurance portals used it during the pandemic. State tax departments use license details as an extra check on returns flagged for identity theft. Benefits applications, vehicle registration renewals, professional licensing and court payment systems often ask for them. Some agencies use the license fields directly. Others rely on commercial identity verification services that check the entered data against the motor vehicle record.

In each case the assumption is the same. Only the genuine person, or someone holding the physical card, would know these values. That assumption was always weak, because licenses are photocopied by landlords, employers and car dealers. MOVEit removed what was left of it in two states.

Why a wholesale leak breaks it for everyone

A breach of one agency’s files normally harms the people in those files. A breach of a foundational record set is different. It changes the verification assumptions of every relying party that uses the same data, whether or not that party ran the vulnerable software.

Three features made the motor vehicle exposures especially damaging. Coverage was near total, so a fraudster could expect to find almost any adult resident in the data. The fields were exactly those used in checks: name, date of birth, address, license number and physical description. And the data does not expire on any useful timescale. A license number can stay the same for decades, and agencies rarely reissue numbers after a breach because doing so is expensive and disruptive.

The practical consequence is that a check passed with stolen license data looks identical to a legitimate one. Fraud teams cannot tell them apart from the answers alone. Agencies that treated a correct license number as strong evidence were, from June 2023, treating public information as a credential.

What should replace it

No single control replaces knowledge-based checks. The workable answer is to tier verification by the harm a wrong decision would cause, then use stronger evidence where the harm is higher.

Low-risk transactions, such as checking an application’s status or booking an appointment, can continue to accept knowledge factors. Ideally these are combined with signals the attacker does not control, such as a device the resident has used before.

Medium-risk transactions, such as changing a mailing address or contact details, should require a second channel. A one-time code sent to contact details already on file works, as does a letter to the address on record before the change takes effect. The delay is a feature: it gives the genuine resident a chance to object.

High-risk transactions, such as redirecting benefit payments, issuing a replacement credential or releasing tax refunds, need evidence that cannot be copied from a breached file. Options include document verification with a live selfie match, in-person proofing at an office or partner location, and verification through a federated government identity service. Each needs an alternative for people who cannot or will not use biometrics.

The tiering has to be explicit and owned. A program office should sign a short table listing each transaction, its risk tier and the evidence required. That table becomes the thing auditors test and vendors are contracted against. Agencies buying identity verification should also ask vendors which data sources each check relies on. A check that compares entered license data with the motor vehicle record proves nothing once that record is public.

There is a cost. Stronger proofing adds friction, and friction falls hardest on older residents, people without smartphones and people with thin credit files. The tiering approach limits that cost to the transactions where fraud does real harm.

What residents need to be told

Louisiana and Oregon told residents to monitor their credit and consider freezes. That advice addresses credit fraud. It does nothing about government benefits fraud, which does not touch a credit file.

Residents needed three further messages. First, that the agency will never ask for license details by phone or text, so any such request is a scam. Second, how to report suspected misuse of their identity to each major program: unemployment, tax, benefits and vehicle titles. Third, where they could set up an account protected by stronger sign-in before a criminal did it for them. Pre-registration matters because many benefits frauds rely on creating the first online account in a victim’s name.

These messages need coordination across agencies that rarely talk to each other. A state chief information officer or chief privacy officer is usually the right owner. Waiting for each program to issue its own notice produces inconsistent advice, and inconsistency is what phishing campaigns exploit.

With hindsight

MOVEit became one of the largest data theft campaigns on record, touching thousands of organizations, many through vendors. The motor vehicle exposures fed a shift in government identity practice that was already under way. Login.gov began piloting a selfie-to-ID facial matching option in 2024, designed to meet NIST’s IAL2 assurance level, and offered alternatives for people who opted out. NIST finalized a major revision of its digital identity guidelines, SP 800-63-4, in 2025, with more attention to alternative proofing paths and to the risks of relying on data an attacker may already hold. More states issued mobile driver’s licenses, and more agencies began accepting them. Knowledge-based checks did not disappear, and public evidence on how individual agencies adjusted is thin. The underlying point stands: a breach of a record set that others rely on changes the assumptions of everyone who relies on it.