In 2023, the Departments of Motor Vehicles (DMVs) in both Louisiana and Oregon were hit by a major data breach that exposed the personal information of millions of residents.

The breach was part of a broader cyberattack campaign exploiting a zero-day vulnerability (CVE-2023-34362) in the MOVEit Transfer software, a secure file transfer tool used by many organizations worldwide. The Russian-linked Clop ransomware gang was identified as the group behind the attack.

In Louisiana, the breach affected nearly all holders of driver’s licenses, state IDs, and vehicle registrations—impacting over 6 million individuals. Exposed data included names, addresses, Social Security numbers, dates of birth, driver’s license numbers, and even vehicle and handicap placard information. Similarly, Oregon’s DMV reported that approximately 3.5 million residents had their data compromised, including names, addresses, and the last four digits of their Social Security numbers. Both states urged residents to take protective measures such as monitoring credit reports, resetting passwords, and obtaining IRS Identity Protection PINs to guard against identity theft.

The 2023 DMV data breaches underscore a critical truth: IT professionals must remain constantly vigilant against cyber threats. "Bad actors" are continually evolving their tactics, exploiting newly discovered vulnerabilities—often before patches are available or widely applied. Tools like MOVEit Transfer, while designed for secure data handling, can become gateways for intrusion if not properly monitored and updated. For IT teams, this means staying informed about emerging threats, applying security patches promptly, conducting regular audits, and implementing layered defenses. Cybersecurity is no longer a one-time setup—it’s an ongoing, proactive discipline that protects not just systems, but the trust and safety of millions of users.