Vehicle owner data at risk — contractor for DMV hacked

Personal information for possibly millions of California drivers may have been accessible to hackers after a company contracting with the California Department of Motor Vehicles suffered a security breach earlier this month.

Law enforcement and the FBI are investigating a ransomware attack that targeted Automatic Funds Transfer Services, a Seattle company that handles billing and statement processing, and may have exposed DMV vehicle registration records that contain names, addresses, license plate numbers and vehicle identification numbers, officials said. In general, a ransomware attack infects and locks down a computer or network and demands a payment in order for the system to work again.

The breach could potentially affect all Cali

fornians who registered a vehicle within the last 20 months, with an estimated 38 million records compromised, DMV spokeswoman Anita Gore said. DMV systems have not been breached, the agency said. Officials did not specify how many people might be affected.

“We are investigating this recent data breach ... in order to quickly provide clarity on how it may impact Californians,” DMV Director Steve Gordon said in a statement. “We are looking at additional measures to implement to bolster security to protect information held by the DMV and companies that we contract with.”

The DMV immediately stopped all data transfers to the company after being notified of the potential breach.

Representatives for Automatic Funds were not available for comment. The company’s website was down “due to technical issues” on Thursday.

Gore said customers’ Social Security numbers, payment information, birth dates, voter registration information, immigration status and driver’s license information was not compromised because the DMV did not share this data with the vendor.

The DMV has contracted with Automatic Funds since 2019 to crossreference customers’ addresses with the U.S. Postal Service database to ensure vehicle registration renewal notices are mailed to the correct address. The agency said it is initiating an emergency contract with a different company to prevent service interruptions.

DMV officials are reviewing the company’s processes to determine what security enhancements are needed to prevent future breaches.

“While the DMV Investigations branch has no indication at this time that information accessed by the ransomware attack on AFTS has been used by the attackers for any nefarious reason, the DMV urges customers to report any suspect activity to law enforcement,” Gore said.