Millions of Americans are facing a significant threat to their personal data as a result of a massive cyberattack targeting the widely used file-transfer program known as MOVEit. The impact so far is vast, even compromising residents of Louisiana and Oregon who possess driver’s licenses or state identification cards, and there are concerns among officials that the number of affected individuals could increase sizably. Moreover, this breach has far-reaching consequences, impacting numerous firms and organizations, including multinational corporations, federal and state agencies, and universities.
Millions of driver’s license data stolen
The Louisiana Office of Motor Vehicles (OMV) says that the data of all individuals in Louisiana who possess a state-issued driver’s license, ID, or car registration may have been compromised and exposed by this attack. The OMV says that those impacted likely had the following personal information exposed: name, address, social security number, birth date, height, eye color, driver’s license number, vehicle registration information, and handicap placard information. The Oregon DMV says that its MOVEit Transfer data breach impacted approximately 3,500,000 Oregonians with an ID or driver’s license.
Who else has been affected?
Aside from those residents affected in Oregon and Louisiana, numerous large corporations across the world have stated that their data was affected, including BBC, British Airways, and Aon. Multiple U.S. federal agencies and universities also have been impacted by the breach, including the Department of Energy. One Senior U.S. official stated that hundreds of companies could end up being hit by this data breach.
How did this data breach happen?
Whoever hacked this information was able to do so by exploiting a flaw in a commonly-used data file-transfer software called MOVEit, which was made by the Massachusetts-based Progress Software Corporation. The U.S. government and many companies use MOVEit to send large files.
Has the stolen data been sold or released?
There has been no record yet of this data being sold or released. MOVEit has been ordered by cybersecurity experts and federal agencies to continue to give updates on the breach. However, the team at MOVEit, unfortunately, found another vulnerability in their software that they are now focusing on fixing.
Who is taking responsibility for the attack?
A Russian hacker group called Clop is taking credit for the attack. The group has previously been known to demand multimillion-dollar ransoms. As of yet, the U.S. government has not received any requests for money from the group. Clop is instead focusing on getting money from larger corporations.
What if my information was compromised?
If you are a resident of either Louisiana or Oregon or anyone else concerned about protecting themselves from identity fraud, here are some steps you can take:
Steps to take to protect yourself against identity fraud
1) Monitor your accounts
Regularly review your bank statements, credit card statements, and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.
2) Place a fraud alert
Contact one of the three major credit reporting agencies (Equifax, Experian, or TransUnion) and request a fraud alert to be placed on your credit file. This will make it more difficult for identity thieves to open new accounts in your name without verification.
3) Check your credit reports
Obtain a free copy of your credit report from each of the three credit reporting agencies mentioned earlier. Review the reports carefully for any suspicious or unauthorized activity. If you find any inaccuracies or signs of fraud, report them to the credit reporting agency immediately.
4) Freeze your credit
Consider placing a credit freeze on your credit reports. This will restrict access to your credit file, making it difficult for anyone to open new accounts using your information. Keep in mind that this may also affect your ability to apply for new credit, so weigh the pros and cons before opting for a credit freeze.
5) Invest in identity theft protection
1 million dollars to cover losses and legal fees white glove fraud resolution team where a US-based case manager
Special for CyberGuy Readers:
MORE: MASSIVE DISTRIBUTION OF MALWARE EXPOSES GAMERS TO THEFT AND DATA BREACHES
6) Be cautious of phishing attempts
Be vigilant about emails, phone calls, or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request. Invest in antivirus software.
7) Enable two-factor authentication
Enable two-factor authentication whenever possible. This adds an extra layer of security by requiring a second form of verification, such as a code sent to your phone, in addition to your password.
8) Check Social Security benefits
It is crucial to periodically check your Social Security benefits to ensure they have not been tampered with or altered in any way, safeguarding your financial security and preventing potential fraud.
9) Request an “Identity Protection Pin” from the IRS
By requesting an “Identity Protection Pin” from the Internal Revenue Service, individuals can effectively deter any attempts of unauthorized tax filing using their personal information.
10) Strengthen your passwords
Ensure that you have strong, unique passwords for your online accounts. Consider using a password manager to generate and store complex passwords securely.
11) Keep software up to date
Regularly update your operating system, antivirus software, web browsers, and other applications to ensure you have the latest security patches and protections.
How can I check if my information was sold on the dark web?
To check if your information was sold on the dark web, you can go to haveibeenpwned.com and enter your email address into the search bar. The website will search to see what data of yours is out there and display if there were data breaches associated with your email address on various sites.
If you find your data is out on the web, here’s how you can remove it.
Kurt’s key takeaways
Regrettably, occurrences like this latest massive cyberattack have become commonplace, highlighting the urgent need for preventative measures by all of us. It is crucial to be proactive in safeguarding your personal information. I recommend you follow my precautions above to stay one step ahead of cybercriminals.
What more do you think could be done about data breaches and protecting people’s private information? Let us know by commenting below.
FOR MORE OF MY SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Related:
- Massive free VPN data breach exposes 360M records
- Massive distribution of malware exposes gamers to theft and data breaches