Millions of Texans’ DMV Records Exposed in Vertafore Data Breach, Class Action Lawsuit Claims

The entire Texas Department of Motor Vehicles’ database was exposed in a 2020 Vertafore data breach compromising the sensitive information of 27.7 million Texans, including their names, addresses, birthdates, and social security numbers.

That’s according to a class action lawsuit filed by lead plaintiff Aaron Mulvey, who blames the breach on Vertafore’s “glaring weaknesses and vulnerabilities” in its data computing systems that left the Personal Identifying Information (PII) ripe for picking by cybercriminals.

“Reportedly, databases of PII involving Texas consumers were accessed, without authorization,” states the Vertafore data breach class action lawsuit, which goes on to say that, “[o]n a scale of 1 to 10, in terms of risk to consumers, this data event was a 10.”

The class action lawsuit alleges that the data breach began on March 11, 2020 and the company discovered the problem in August; however, it was not until Nov. 10 of that year that Vertafore announced that “it was subject to one of the largest data events in Texas history.”

According to the plaintiff, Vertafore is a Colorado-based company that collects and sells consumer information as a part of management system services it offers to agencies, such as the Texas Department of Motor Vehicles. The complaint goes on to detail efforts by Vertafore to aggressively and rapidly expand into the consumer data management sector, including the purchase of smaller companies.

However, Vertafore failed to make appropriate investments in employee training in cybersecurity, which lead to the 2020 data breach, according to the complaint. One of these purchases included QQ Solutions, a Florida-based company that offers agency management software products. QQ allegedly used software that required continual updates using Texas motor vehicle records.

This software left the PII of millions of Texans exposed and violated the Driver Privacy Protection Act, that class action lawsuit asserts.

The Vertafore data breach allegedly affects anyone with a driver’s license number issued before February of 2019.

“The public concern being, using this information, identity thieves can then create fake identities, fraudulently obtain loans and tax refunds, and destroy a consumer’s insurance-worthiness—the very thing Defendant Vertafore exists to assess and report,” points out the class action lawsuit.

“And because some of their PII is not able to be replaced, such as driver license and vehicle registration numbers, thieves will be able to do so for years to come.”

Mulvey says that his personal information was exposed in the Vertafore data breach and he’s seeking to represent other consumers nationwide who also had their information compromised. The class action lawsuit accuses Vertafore of negligence and violating the Driver Privacy Protection Act. It is seeking damages, along with a court order forcing the company to stop collecting and using motor vehicle records for its databases.

Was your personal information exposed in the Vertafore data breach? Tell us about your experience in the comment section below.

The lead plaintiff, Aaron Mulvey, and proposed Class Members are represented by Joseph H. Malley of Law Offices of Joseph H. Malley P.C.

The Vertafore Data Breach Class Action Lawsuit is Mulvey v. Vertafore Inc., Case No. 3:21-cv-00213-E, in the U.S. District Court for the Northern District of Texas.

Read About More Class Action Lawsuits & Class Action Settlements:

• Rady Children’s Hospital Hit With Class Action After Ransomware Attack
• T.J. Maxx Shoppers Allege Privacy Breach in Class Action Lawsuit
• Credit and Debit Card Receipt Privacy Lawsuit Investigation
• Do You Qualify: TCPA Class Action Lawsuit Investigation