Millions of Driver’s License Numbers Exposed in Latest Major Data Breach

Latitude Financial Services confirmed that 7.9 million Australian and New Zealand driver’s license numbers were stolen in what authorities are calling Australia’s largest cyberattack, marking an escalation in the scale and sensitivity of personal data compromised in recent breaches. The incident has exposed driver’s license numbers and dates of birth across two countries, intensifying scrutiny on financial services companies’ security infrastructure. The breach joins a cascade of similar incidents across North America and the Asia-Pacific region that have collectively exposed tens of millions of driver’s license records to criminal networks.

The Scale of the Crisis Widens Across Multiple Jurisdictions

Driver’s license data has become a primary target for cybercriminals, with breaches now affecting millions of individuals across multiple countries and sectors. Beyond Latitude Financial Services’ 7.9 million records, the Texas Parks and Wildlife Department disclosed that hackers accessed a third-party vendor’s systems and exposed driver’s license numbers, passport numbers, social security numbers, and residential addresses of 3,087,721 people. The Oregon Department of Transportation separately reported that 3.5 million driver’s licenses or ID cards were compromised through an International attack exploiting the MOVEit software vulnerability, which forced ODOT to close the vulnerability on June 1 and notify law enforcement.

In the United States, the New York Attorney General’s office secured $14.2 million in settlements from eight car insurance companies that failed to protect 825,000 New Yorkers’ data in breaches targeting quoting tools. Those breaches illustrate how attackers strategically target companies handling sensitive identification documents, with stolen data subsequently used to file fraudulent unemployment claims during the COVID-19 pandemic. The regulatory action underscores mounting pressure on companies to fortify defenses protecting driver’s license information, which serves as a gateway to identity theft and fraud schemes.

Why Driver’s License Data Has Become a High-Value Target

Read also: How Savi’s App Is Fighting Back Against Convincing AI-Powered Scams and Kidnapping Hoaxes · Politician Investigating Spyware Abuses Has His Phone Hacked With Pegasus · Venice AI Reaches Unicorn Status: Raises $65M Series A for Privacy-First AI Platform

Driver’s license numbers represent far more than a simple identifier—they function as a master key for identity theft because they combine unique personal identifiers with government verification and are widely accepted as proof of identity in financial transactions. The Fourth Circuit Court of Appeals reinforced the severity of driver’s license exposure in Holmes v. Elephant Insurance Co. (No. 23-1782, Oct. 14, 2025), ruling that public disclosure of driver’s license numbers constitutes “concrete injury” sufficient to establish legal standing for data breach lawsuits. The decision, citing the TransUnion v. Ramirez precedent, acknowledges that exposed driver’s license numbers create measurable harm even before fraudulent activity occurs.

The Identity Theft Resource Center documented that driver’s license account misuse surged to 15 percent of all government account takeovers in 2022, up sharply from just 4 percent previously. This spike reflects criminals’ strategic focus on driver’s license credentials as entry points for downstream fraud, including unemployment insurance fraud, tax refund theft, and synthetic identity creation. Experts now recommend that individuals affected by driver’s license breaches implement credit freezes and enroll in identity monitoring services, with affected individuals from the Texas Parks and Wildlife Department breach receiving one year of free credit monitoring through Kroll, with enrollment ending September 14, 2026.

Regulatory Enforcement and Industry Accountability Accelerates

The New York Attorney General’s settlements signal intensifying regulatory pressure on companies handling sensitive government-issued identification. New York’s enforcement action required eight car insurance companies to collectively pay $14.2 million for failing to implement adequate safeguards on systems processing driver’s license data, establishing a precedent that regulators will hold organizations financially accountable for breaches of identification documents. The action specifically targeted breaches that exposed data used in fraudulent unemployment claims, demonstrating that regulators now consider downstream fraud consequences when calculating enforcement penalties.

These enforcement actions are occurring alongside a fundamental shift in how breaches occur. According to the Verizon Data Breach Investigations Report for 2026, software vulnerabilities now serve as the primary entry point for 31 percent of breaches, surpassing stolen passwords as the top attack vector. This shift explains the prevalence of MOVEit-related breaches, as hackers increasingly exploit unpatched software rather than relying on credential theft. The transition creates challenges for regulators and companies alike, requiring organizations to prioritize patch management and vulnerability disclosure processes rather than focusing solely on password security.

A Historical Pattern of Escalating Breach Severity

The current wave of driver’s license breaches represents a troubling escalation in both the volume and sensitivity of exposed data. The MOVEit vulnerability alone impacted over 94 million users globally and caused more than $15 billion in damages by early 2024, with 88 percent of victims being US corporations including the US Department of Energy, Johns Hopkins University, and the New York City Department of Education. Beyond MOVEit, threat actors including ShinyHunters claimed exfiltration of 275 million records across approximately 9,000 institutions, with analysis identifying approximately 231 million unique email addresses and extensive driver’s license details.

The Carnival breach exemplified the scale of modern data exfiltration, with the company notifying approximately 6 million individuals and affecting 7.5 million loyalty accounts. These incidents underscore that driver’s license breaches no longer occur in isolation but rather as components of sprawling multi-million-record exfiltrations targeting diverse sectors from insurance to government to hospitality.

Critical Dates and Developments on the Horizon

The Texas Parks and Wildlife Department breach represents one of the largest data breaches affecting the state in 2026, with the nature and timing of the incident remaining partially unspecified as authorities continue investigating the vendor handling hunting and fishing licenses. Affected individuals should monitor credit reports closely and consider implementing credit freezes, particularly given the exposure of social security numbers alongside driver’s license data. The Oregon ODOT breach, discovered and closed in June, will likely trigger additional regulatory inquiries as state attorneys general examine whether transportation departments across the country face similar MOVEit vulnerabilities.

Organizations handling driver’s license data now face mounting pressure to implement robust patch management, conduct regular vulnerability assessments, and establish rapid incident response protocols. The convergence of regulatory enforcement, judicial recognition of driver’s license exposure as concrete harm, and the documented prevalence of software vulnerabilities as the primary attack vector indicates that companies failing to prioritize identification document security will face both legal liability and reputational damage. As cybercriminals continue targeting driver’s license repositories across government and private sector organizations, the incidents documented in 2026 will likely establish the baseline for evaluating organizational security maturity in the years ahead.