Oregon has suspended internet sales of hunting and fishing licenses indefinitely while it investigates an apparent security breach in the private vendor used by Oregon and several other states to sell licenses online.
A self-professed computer hacker on Tuesday notified the Oregon Department of Fish and Wildlife and similar agencies in Washington and Idaho that he had breached the security of the license-sales vendor they use called “Active Outdoors,” authorities said.
The hacker identified himself as “Mr. High,” and it was sent from an email address at johnisthedoemail.com, ODFW spokesman Richard Hargrave said.
ODFW technicians Tuesday closed the internet portal and did their own investigation with Active Outdoors and found no evidence of loss of data in the system, which includes names, dates of birth and Social Security numbers of nearly 967,000 license holders, Hargrave said.
However, the Office of the State Chief Information Officer today closed the internet portal indefinitely while its “enterprise security team” investigates whether any private information was compromised, office spokesman Matt Shelby said.
“Our central folks aren’t saying with any confidence that system is totally secure,” Shelby said. “Basically, it will be down until we have reasonable confidence that the data Oregonians are putting in there is secure.”
Until then, hunters, anglers and shellfish harvesters can purchase their licenses and tags either directly from ODFW field offices or through the point-of-sale licensing system at retail outlets statewide, Shelby said. Those systems remain open during the investigation, he said.
Hargrave said about 18 percent of the department’s licenses and tags are sold though the internet portal. The majority are sold through the POS system, he said.
In Oregon, hunters and anglers are required to furnish their Social Security number or sign a waiver saying they have none, but that requirement is only during the first time they buy a license, and the Social Security number is not used to track people or purchases, Hargrave said. Licensees are then issued a hunter or angler identification number, and all subsequent transactions from that purchase on are traced from that number, he said.
Licenses also contain information that is of public record in Oregon, such as names, birth dates, licenses and tags purchased, addresses and telephone numbers, Hargrave said.
Hargave said Mr. High’s email did not ask for a ransom but said that he or she found a problem and that officials need to fix it.
Washington is conducting a similar probe and has shut down its entire licensing system and lifted fishing-license and tag restrictions through Tuesday during its probe.
