SACRAMENTO, Calif. – An investigation is underway after the California Department of Motor Vehicles (DMV), announced Wednesday that a company it uses to verify vehicle registration addresses has had a security breach.
DMV systems have not been compromised and it is unknown if DMV data shared with the company has been compromised, according to officials with the DMV.
"Automatic Funds Transfer Services, Inc. (AFTS) of Seattle was the victim of a ransomware attack in early February that may have compromised information provided to AFTS by the DMV, including the last 20 months of California vehicle registration records that contain names, addresses, license plate numbers and vehicle identification numbers (VIN)," said the DMV in a news release. "AFTS does not have access to DMV customers’ Social Security numbers, birthdates, voter registration, immigration status or driver’s license information, therefore this data was not compromised."
The DMV said it immediately stopped all data transfers to AFTS and notified law enforcement, including the Federal Bureau of Investigation.
“Data privacy is a top priority for the DMV. We are investigating this recent data breach of a DMV vendor in order to quickly provide clarity on how it may impact Californians,” DMV Director Steve Gordon said. “We are looking at additional measures to implement to bolster security to protect information held by the DMV and companies that we contract with.”
The DMV has contracted with AFTS since 2019 to cross-reference addresses with the national database – which gets updated whenever someone files a change of address with the U.S. Postal Service National Change of Address Database – to ensure vehicle registration renewal notices are mailed to a customer’s current address.
Officials with the DMV Investigations branch said they currently have no indication that information accessed by the ransomware attack on AFTS has been used by the attackers for any nefarious reason. Officials at the DMV are urging customers to report any suspicious activity to law enforcement.