Washington State Database Hack Exposes Sensitive Data of 6,50,000 People

Investigators believe hackers stole at least some of the Social Security numbers and other sensitive personal data of 650,000 current and former Washington state professionals and business owners during a breach of a state database. The Seattle Times reports the Department of Licensing officials confirmed the figures Friday. The breach, which was detected January 24 and disclosed last week, affected personal data in active, expired, revoked or suspended licenses for 23 of the 39 professions and businesses that require state licensing.

Affected data included such information as Social Security numbers, driver's license numbers, and dates of birth. Data from the department's driver's license system wasn't affected, agency officials said.

“Based on our investigation, (Department of Licensing) has sufficient reason to believe the Professional and Business Licensing System was accessed, and records were acquired without authorization,” the agency said in an updated statement on its website.

The database is maintained by Salesforce, a San Francisco software company.

The agency will begin notifying individuals who were potentially affected by the breach and providing them with credit monitoring and identity theft protection.

Agency officials had initially said that the breach might have exposed the data of at least the 2,57,000 individuals' active licenses in the system but acknowledged that the full number was likely larger. Friday's estimate grew to 6,50,000 because it included individuals with non-active licenses, and also because a single business license can include information for multiple individuals, Olson said.

Investigators still haven't determined whether the potential breach occurred within the agency, in the database or in some other part of the data system, said agency spokesperson Nathan Olson.

On Monday, a Salesforce spokesperson said that, “at this time, we have no evidence of a vulnerability inherent to the Salesforce platform.”

The breach remains under investigation by the state Office of Cybersecurity, the state Attorney General's Office and a third-party cybersecurity firm, CrowdStrike, Department of Licensing officials said.