Millions of Americans are facing a significant threat to their personal data as a result of a massive cyberattack targeting the widely used file-transfer program known as MOVEit. The impact so far is vast, even compromising residents of Louisiana and Oregon who possess driver’s licenses or state identification cards, and there are concerns among officials that the number of affected individuals could increase sizably. Moreover, this breach has far-reaching consequences, impacting numerous firms and organizations, including multinational corporations, federal and state agencies, and universities.
Millions of driver’s license data stolen
The Louisiana Office of Motor Vehicles (OMV) says that the data of all individuals in Louisiana who possess a state-issued driver’s license, ID, or car registration may have been compromised and exposed by this attack. The OMV says that those impacted likely had the following personal information exposed: name, address, social security number, birth date, height, eye color, driver’s license number, vehicle registration information, and handicap placard information. The Oregon DMV says that its MOVEit Transfer data breach impacted approximately 3,500,000 Oregonians with an ID or driver’s license.
Who else has been affected?
Aside from those residents affected in Oregon and Louisiana, numerous large corporations across the world have stated that their data was affected, including BBC, British Airways, and Aon. Multiple U.S. federal agencies and universities also have been impacted by the breach, including the Department of Energy. One Senior U.S. official stated that hundreds of companies could end up being hit by this data breach.
How did this data breach happen?
Whoever hacked this information was able to do so by exploiting a flaw in a commonly-used data file-transfer software called MOVEit, which was made by the Massachusetts-based Progress Software Corporation. The U.S. government and many companies use MOVEit to send large files.
Has the stolen data been sold or released?
There has been no record yet of this data being sold or released. MOVEit has been ordered by cybersecurity experts and federal agencies to continue to give updates on the breach. However, the team at MOVEit, unfortunately, found another vulnerability in their software that they are now focusing on fixing.
Who is taking responsibility for the attack?
A Russian hacker group called Clop is taking credit for the attack. The group has previously been known to demand multimillion-dollar ransoms. As of yet, the U.S. government has not received any requests for money from the group. Clop is instead focusing on getting money from larger corporations.
What if my information was compromised?
If you are a resident of either Louisiana or Oregon or anyone else concerned about protecting themselves from identity fraud, here are some steps you can take:
Steps to take to protect yourself against identity fraud
1) Monitor your accounts
Regularly review your bank statements, credit card statements, and other financial accounts for any unauthorized activity. If you notice any suspicious transactions, report them immediately to your bank or credit card company.
2) Place a fraud alert
Contact one of the three major credit reporting agencies (Equifax, Experian, or TransUnion) and request a fraud alert to be placed on your credit file. This will make it more difficult for identity thieves to open new accounts in your name without verification.
3) Check your credit reports
Obtain a free copy of your credit report from each of the three credit reporting agencies mentioned earlier. Review the reports carefully for any suspicious or unauthorized activity. If you find any inaccuracies or signs of fraud, report them to the credit reporting agency immediately.
4) Freeze your credit
Consider placing a credit freeze on your credit reports. This will restrict access to your credit file, making it difficult for anyone to open new accounts using your information. Keep in mind that this may also affect your ability to apply for new credit, so weigh the pros and cons before opting for a credit freeze.
5) Invest in identity theft protection
If you want a service that will walk you through every step of the reporting and recovery process, one of the best things you can do to protect yourself from this type of fraud is to subscribe to an identity theft service. My top recommendation is Identity Guard.
Identity Guard will monitor personal information like your Home title, Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
One of the best parts of using Identity Guard includes identity theft insurance of up to 1 million dollars to cover losses and legal fees and a white glove fraud resolution team where a US-based case manager helps you recover any losses.
Special for CyberGuy Readers: Save up to 51% with my top recommendation is Identity Guard.
Read more of my review of best identity theft protection services here.
MORE: MASSIVE DISTRIBUTION OF MALWARE EXPOSES GAMERS TO THEFT AND DATA BREACHES
6) Be cautious of phishing attempts
Be vigilant about emails, phone calls, or messages from unknown sources asking for personal information. Avoid clicking on suspicious links or providing sensitive details unless you can verify the legitimacy of the request. Invest in antivirus software.
7) Enable two-factor authentication
Enable two-factor authentication whenever possible. This adds an extra layer of security by requiring a second form of verification, such as a code sent to your phone, in addition to your password.
8) Check Social Security benefits
It is crucial to periodically check your Social Security benefits to ensure they have not been tampered with or altered in any way, safeguarding your financial security and preventing potential fraud.
9) Request an “Identity Protection Pin” from the IRS
By requesting an “Identity Protection Pin” from the Internal Revenue Service, individuals can effectively deter any attempts of unauthorized tax filing using their personal information.
10) Strengthen your passwords
Ensure that you have strong, unique passwords for your online accounts. Consider using a password manager to generate and store complex passwords securely. It will help you to create unique and difficult-to-crack passwords that a hacker could never guess. Second, it also keeps track of all your passwords in one place and fills passwords in for you when you’re logging into an account so that you never have to remember them yourself. The fewer passwords you remember, the less likely you will be to reuse them for your accounts.
One of the best password managers out there is 1Password. With no known security breaches or vulnerabilities, 1Password is a solid option as a paid password manager. It utilizes a well-designed interface, which features core components that are expected from premium, paid password managers. At the time of publishing, it starts at $2.99 a month, billed annually, for a total of $35.88/year, and you can save more with a family option which includes 5 family members for $60/year.
Get more details about my best expert-reviewed Password Managers of 2023 here.
11) Keep software up to date
Regularly update your operating system, antivirus software, web browsers, and other applications to ensure you have the latest security patches and protections.
How can I check if my information was sold on the dark web?
To check if your information was sold on the dark web, you can go to haveibeenpwned.com and enter your email address into the search bar. The website will search to see what data of yours is out there and display if there were data breaches associated with your email address on various sites.
If you find your data is out on the web, here’s how you can remove it.
Kurt’s key takeaways
Regrettably, occurrences like this latest massive cyberattack have become commonplace, highlighting the urgent need for preventative measures by all of us. It is crucial to be proactive in safeguarding your personal information. I recommend you follow my precautions above to stay one step ahead of cybercriminals.
What more do you think could be done about data breaches and protecting people’s private information? Let us know by commenting below.
FOR MORE OF MY SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE
Related:
- Massive free VPN data breach exposes 360M records
- Massive distribution of malware exposes gamers to theft and data breaches