SACRAMENTO — The California Department of Motor Vehicles has issued a notice to customers regarding a security breach that may have compromised vehicle registration records.
Automatic Funds Transfer Services, Inc. of Seattle was the victim of a ransomware attack in early February that may have compromised information provided by the DMV, including the last 20 months of California vehicle registration records that contain names, addresses, license plate numbers and vehicle identification numbers, according to a DMV news release.
AFTS does not have access to DMV customers’ Social Security numbers, birthdates, voter registration, immigration status or driver’s license information, so this data was not compromised, officials said.
After learning of the breach, the DMV stopped all data transfers to AFTS and notified law enforcement, including the FBI.
“Data privacy is a top priority for the DMV. We are investigating this recent data breach of a DMV vendor in order to quickly provide clarity on how it may impact Californians,” Steve Gordon, DMV director, said in a statement. “We are looking at additional measures to implement to bolster security to protect information held by the DMV and companies that we contract with.”
The DMV has contracted with AFTS since 2019 “to cross-reference addresses with the national database — which gets updated whenever someone files a change of address with the U.S. Postal Service National Change of Address Database — to ensure vehicle registration renewal notices are mailed to a customer’s current address,” officials said, adding that the DMV does not use the service to verify driver’s license addresses.
The DMV has initiated an emergency contract with a different address verification company and reviewing its processes with AFTS to determine what is needed to prevent future breaches.
“While the DMV Investigations branch has no indication at this time that information accessed by the ransomware attack on AFTS has been used by the attackers for any nefarious reason, the DMV urges customers to report any suspect activity to law enforcement,” read a news release. “The DMV will continue to monitor the situation and work with the appropriate law enforcement agencies.”
— Mitchell White
