Updated October 14, 2016
About 1.7 million people who bought Washington hunting and fishing licenses before mid-2006 have been notified that their personal information may have been exposed earlier this year to a hacker who gained unauthorized access to a data base maintained by the state's license vendor.
Customers' personal information included their names; addresses; birthdates; driver's license numbers (customers had the option of providing this information)and related details such as height, weight, and eye/hair color; and the last four digits of Social Security numbers (the other five Social Security numbers were encrypted).
No credit card or other financial data was exposed.
The state Office of Cyber Security, federal law enforcement agencies, and the vendor continue to investigate the incident.
ACTIVE Outdoors, the department's hunting and fishing license sales vendor, mailed notices beginning Sept. 19, 2016, to WDFW customers who created "customer profiles" in the license system before July 2006 and whose profiles contained driver's license information. ACTIVE also has established a customer call center (855-260-2772) and a website on identity repair services.
State investigators do not believe personal data is at risk for customers who made their first license purchase after June 2006.
Personal information for approximately 2.2 million license buyers may have been exposed, but fewer people have been notified. For example, some former customers have died, while others' profiles do not include enough information to enable the vendor to contact them.
WDFW suspended all license sales for five days in late August while information technology specialists addressed the security vulnerabilities. The department also offered several "free fishing" days to reduce the impact on customers who wanted to go fishing but could not buy a license while the system was down.
The department worked with the vendor and with the state Office of Cyber Security (OCS) to ensure system security before restoring sales through its network of about 600 retailers on Saturday, Aug. 27, via telephone on Monday, Aug. 29, and restored online sales on Thursday, Oct. 13.
Customers who think they created a customer profile before July 2006 but have not been notified by ACTIVE can contact ACTIVE's call center (855-260-2772) or WDFW's licensing office (360-902-2464).
Officials from ACTIVE emphasize that the company will not call or send emails to WDFW customers to ask for personal information in connection with this incident. Customers should not to provide personal information to anyone who calls them or sends an email about this incident.
Customers can buy hunting and fishing licenses and Discover Passes on line at the license sales website, at WDFW's dealer locations, or by calling the WDFW licensing office (360-902-2464).
WDFW also uses the licensing system for online harvest reporting. To submit a hunting report, go to the harvest reporting website or call 877-945-3492. For information about crab catch reporting, visit WDFW's recreational crab fishing webpage.
Many agencies provide information about how people can protect their personal information, including: