Louisiana warned on June 15, 2023 that anyone holding a state-issued driver's license, identification card or vehicle registration had probably had personal data exposed in the MOVEit Transfer compromise. The announcement came from the office of Governor John Bel Edwards after a briefing with state agency leaders.
The Office of Motor Vehicles said the exposed information could include names, addresses, Social Security numbers, dates of birth, height, eye color, driver's license numbers, vehicle registration details and handicap placard information.
Officials said there was no indication at that stage that the attackers had sold, used, shared or released the data. Because the agency could not identify which individuals were affected, it advised all residents to take precautions: freezing credit with Experian, Equifax and TransUnion, changing online passwords, requesting an identity protection PIN from the Internal Revenue Service, creating a Social Security Administration account and reporting suspected fraud to the Federal Trade Commission.
The breach stemmed from the Clop group's exploitation of a zero-day flaw in Progress Software's MOVEit Transfer, tracked as CVE-2023-34362, beginning in late May 2023.
Oregon made a similar disclosure at the same time. The state's Driver and Motor Vehicle Services said about 3.5 million people holding Oregon identification cards or driver's licenses had data exposed, and likewise said it could not identify specific victims.