Social EngineeringGovernmentGovernmentPhishingTargetedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Washington State Department of Licensing

bd_8c9250c20ee74016 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 15, 2023

Filed

Jan 30, 2024

To disclose

11 weeks

Affected

997state residents only

Confidence

71%

Full breach record for Washington State Department of Licensing →2 incidents on file

Washington State Department of Licensing reported a phishing incident where spoofed websites harvested Secure Access Washington (SAW) credentials between Oct 25 and Nov 20, 2023. Discovered Nov 15, 2023, the breach affected 997 Washington residents, exposing names and driver's license numbers. Notifications began Jan 30, 2024, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d11 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 21 days

discovery → filing · 11 weeks / 76 days

Oct 25, 2023

Begins

Nov 15, 2023

Discovered

Jan 30, 2024

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed997 affectedView incident

Name: Washington State Department of Licensing
norm: washington state department of licensing

Name: Washington State Department of Licensing
norm: washington state department of licensing
Industry: Governmentllm

Discovered: Nov 15, 2023
Breach occurred: Oct 25, 2023 – Nov 20, 2023
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2024
Affected individuals: 997state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameDriver's licence number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Launched an investigation with the assistance of multiple Washington State agencies and a third-party forensic specialist
Began mailing notification letters via United States Postal Service First-Class mail
Established a dedicated, toll-free call center
Offering complimentary credit monitoring and identity theft protection services
Changes made: Implementing several changes to enhance its existing security measures
Taking steps to implement additional safeguards and review policies and procedures relating to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27760.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 30, 2024
Raw hash: 1c4dd6df650f786f87cc4415ada9fd7da053e7d9aa9011eb0b3f8dbaf3f71422

Reporting entityWashington State Department of Licensing

Victim entityWashington State Department of Licensing

Incidentdiscovered Nov 15, 2023

Stated responseLaunched an investigation with the assistance of multiple Washington State agencies and a third-party forensic specialist

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com