A security breach by a hacker calling himself “Mr. High” has forced Washington and Idaho to suspend all online sales of hunting and fishing licenses.
The hacker also claims to have accessed private license information for the states of Oregon and Kentucky. The information includes names, date of birth, addresses, drivers license numbers, and in some cases phone numbers and email addresses.
The Idaho information includes full social security numbers, in the other three states only the last three digits. In Idaho and Washington the information included purchasers’ height, weight and eye color.
“Mr. High” took public credit on the AlphaBay Forum, a darknet site, and by way of proof provided the totals and types of personal information from each website and state.
Visitors to the Washington licensing website are currently greeted with the message “Thank you for visiting our Hunting & Fishing website. The system is temporarily undergoing maintenance. Please try again later. “
The Washington Department of Fish and Wildlife (WDFW) told the outdoor columnist of the Spokesman-Review that it was temporarily suspending the sale of fishing and hunting licenses “while it works with the state Office of Cyber Security to investigate a vulnerability in an outside vendor’s license sale system that was recently exploited in several states, including Idaho”.
Idaho Fish and Game issued a news release on August 25 announcing that it was suspending online license sales indefinitely while an investigation was conducted, but that there was no evidence yet that buyers’ information had been obtained by the hacker.
“Mr. High” claimed however, that “I got six million pieces of personal information.”
The breach apparently involved a vendor, not the internal operations of the Fish and Game departments in the four states. KUOW radio in Seattle identified the vendor as Dallas-based Active Network.
Photo credit: Wikimedia
