WASHINGTON — Kitsap County Attorney Joel Ard says the Washington State Department of Licensing knew and allowed a ‘backdoor’ into its eXpress Licensing platform that exposed the personal information of every Washingtonian with a state-issued ID, CDL, or expired, suspended, and active driver’s licenses from 2018-2025.
Ard filed a tort claim against DOL this week on behalf of clients who had their identity stolen as a result of the unauthorized access.
“By all appearances, the License Express upgrade from September 2018 opened up, you call them a ‘back door’ that allowed anybody to go in and access the licensing information from another person in Washington state.”
Ard says DOL knew about the issue because it opened an investigation in 2019 when licenses were ordered in bunches by a single email mailed to a single address.
“They would have literally batches of dozens or hundreds of licenses sent to any given single address.”
Ard says the signs of fraud were obvious—preloaded credit cards were used for the transactions, several licenses were sent to one address, and when DOL or Washington State Patrol went to investigate an address, no more orders would come, but another address would pop up to make similar orders.
“Anybody with a modicum of computer skills and access to the directions could go in and do this. And lots of different people did.”
The tort claim says the number of claims overwhelmed law enforcement.
“DOL was informed by WSP that the workload of hundreds of new cases a month was more than WSP could handle, and that until DOL remediated the security flaw that was allowing people to steal the identity of thousands of Washingtonians a year, WSP could not take on the constant flood of more cases. DOL still refused to remediate the problem!” the claim read.
Ard says DOL violated state law because it did not notify the Attorney General’s office or the public within 45 days of when the breach was realized.
“Once you have somebody’s driver’s license, that is really just the golden key to access of everything in 21st century America. That’s the thing you need to do just about anything.” Ard said.
Ard says many of his clients, and likely many Washingtonians, didn’t know their identity was compromised until something erroneous happened.
For one woman, it was a notification that her license had come up in a car accident out of state.
"They suddenly discovered they’d been in a car accident in Southern California while driving an Uber. And they say, well, I’m living in Washington. I’m not in California, and I’m NOT an Uber driver. But there’s an example of what somebody might do with a license like that," Ard said.
Ard is hoping to get DOL to pay for credit monitoring services for his clients, and potentially for the whole class of potential victims.
KIRO 7 News reached out to DOL for a response.
A person did reply saying they are working on a statement, but at the time of this posting, it had not been sent.