Millions of Americans' Personal Data Exposed in Global Hack

Millions of people in Louisiana and Oregon have had their data compromised in the sprawling cyberattack that has also hit the US federal government, state agencies said late Thursday. From a report: The breach has affected 3.5 million Oregonians with driver's licenses or state ID cards, and anyone with that documentation in Louisiana, authorities said. The Louisiana governor's office did not put a number on the number of victims but over 3 million Louisianians hold driver's licenses, according to public data. The states did not blame anyone in particular for the hack, but federal officials have attributed a broader hacking campaign using the same software vulnerability to a Russian ransomware gang. The sweeping hack has likely exposed data at hundreds of organizations across the globe and also compromised multiple US federal agencies, including the Department of Energy, as well as data from major corporations in Britain like the BBC and British Airways. The Russian-speaking hackers that claimed credit are known to demand multimillion-dollar ransoms, though US and state governments say they have not received any demands.

Re:Oregon sucks.

[MachineShedFred]

So the breach happened in a private Massachusetts company's software that has hundreds of global organizational clients including several states and the US Government, and your take is that Oregonians and ex-Californians are idiots and deserve to be flooded out?

I think we've found an idiot: you.

So...

[chipperdog]

Will Progress Software now provide "free" identity monitoring for everyone in the USA? Seems to be the extent that software companies are held liable for such breaches. They don't end up paying real damages, so the cycle continues.

Re:

[ranton]

Will Progress Software now provide "free" identity monitoring for everyone in the USA? Seems to be the extent that software companies are held liable for such breaches. They don't end up paying real damages, so the cycle continues.

As of right now, software companies are not liable for security vulnerabilities in their software. Part of Biden administration's national cyber strategy [cybersecuritydive.com] is to work with Congress to draft legislation which will shift more of the responsibility to software companies (today their customers are responsible for scanning for vulnerabilities). But it does single out "software publishers with market power," so it appears they wish to target only the larger software giants with any new legislation. It's unclear if

Assume Your Data is Already Out There. Check!

[Seven Spirals]

Pretty much everyone's personal info has been stolen at least twice. If you don't believe it, get yourself a Tor client and see for yourself (or if you are less intrepid go check Have I Been Pwned? [haveibeenpwned.com]). You'll find you can get SSN's and home addresses for just about anyone. Additionally, if they ever had a government clearance, that means the government collected a metric shitton of private info about them (talked to their gradeschool teachers in the case of a high level SCI clearance) then promptly lost all t

FINALLY

[anonymouscoward52236]

I was waiting to fill in this spot on my Apocalypse Bingo card. "State Driver's License Agency Gets Hacked".

Any word on banks?

[presearch]

As the saying goes, that's where the money is.
Community hospitals and colleges aren't exactly rolling in dough.
Seems like the banks would be the prime target by far.
Have there been any recent successful attacks, and if so, would they ever admit to it?

Re:

[MachineShedFred]

As it turns out, there was at least one bank [kgw.com] caught up in this.