California DMV warns of data breach after a contractor was hit by ransomware

California’s Department of Motor Vehicles is warning of a potential data breach after a contractor was hit by ransomware.

The Seattle-based Automatic Funds Transfer Services (AFTS), which the DMV said it has used for verifying changes of address with the national database since 2019, was hit by an unspecified strain of ransomware earlier this month.

In a statement sent by email, the DMV said that the attack may have compromised “the last 20 months of California vehicle registration records that contain names, addresses, license plate numbers and vehicle identification numbers.” But the DMV said AFTS does not have access to customers’ Social Security numbers, dates of birth, voter registration, immigration status or driver’s license information, and was not compromised.

The DMV said it has since stopped all data transfers to AFTS and has since initiated an emergency contract to prevent any downtime.

AFTS is used across the United States to process payments, invoices and verify addresses. Several municipalities have already confirmed that they are affected by the data breach, suggesting it may not be limited to California’s DMV. But it’s not known what kind of ransomware hit AFTS. Ransomware typically encrypts a company’s files and will unlock them in exchange for a ransom. But since many companies have backups, some ransomware groups threaten to publish the stolen files online unless the ransom is paid.

AFTS could not be immediately reached for comment. Its website is offline, with a short message: “The website for AFTS and all related payment processing website [sic] are unavailable due to technical issues. We are working on restoring them as quickly as possible.”

“We are looking at additional measures to implement to bolster security to protect information held by the DMV and companies that we contract with,” said Steve Gordon, the director of the state’s DMV.

Last year it was reported that California’s DMV makes more than $50 million a year by selling drivers’ personal information, including to bondsmen and private investigators.

California has more than 35 million registered vehicles.