UPDATE: Active Network plans to mail notices to license holders whose personal information might have been accessed, Idaho Fish and Game said Thursday in a press release.
The breach of Active Network’s system affects people who first bought a license or tag from any Idaho vendor before 2008. Those who didn’t begin making purchases until 2008 or later weren’t affected.
Active Network has only said it’s possible the customer information was compromised. It’s unknown whether the ongoing investigation will determine whether the information was actually compromised.
• • •
Sign Up and Save
Get six months of free digital access to The Idaho Statesman
Idaho hunters and anglers who began purchasing licenses and tags before 2008 may have had their Social Security numbers and other personal data accessed during a breach of the online-purchasing system, Idaho Fish and Game announced Friday.
Customers who began making purchases in 2008 or later weren’t exposed, Fish and Game said.
Texas-based Active Network, which owns and operates the online system, told Fish and Game on Friday “that it cannot confirm whether any personal information was actually taken but that it is possible,” Fish and Game said in a press release.
Fish and Game announced Wednesday that it had suspended online sales until data could be secured. That suspension continues. Licenses and tags still can be purchased through Fish and Game offices and about 400 businesses, which use a separate system.
Information in the database includes names, ages, addresses and Social Security numbers. Idaho Fish and Game is required by state law to obtain that information to issue a license, according to the release.
Active Network provided a written statement to the Idaho Statesman but declined to answer specific questions about the breach.
“On Aug. 22, we became aware that we were the victim of an unauthorized and unlawful attempt to access our online hunting and fishing licensing applications in Idaho, Oregon, and Washington,” the statement reads. “All indications are that this potential threat was isolated. Consistent with our long-standing and comprehensive security procedures, our team took immediate action. Within 15 hours, we conducted a full security sweep and tested and released an update to the three applications to address the reported threat. As an additional protective measure, we have engaged a top-tier cybersecurity firm to conduct a review. Protecting customer information has always been our highest priority. It is important to note that we have not received any reports of misuse of personal information related to this reported threat. Our applications remain operational and we are committed to working with our state customers and law enforcement to assist in their own investigations of this matter.”
Q&A provided by Idaho Fish and Game
Who is potentially affected?
Idaho residents and nonresidents who started buying hunting and fishing licenses and tags before 2008. Those who made their first license purchase after 2008 are not at risk.
Was my information stolen?
We won’t know. Active Networks can only confirm that it is possible.
What should I do?
Fish and Game recommends license buyers follow the advice of the Idaho Attorney General’s office and monitor their financial accounts and credit history for any signs of suspicious activity (see below).
What has Fish and Game done to protect my information?
Idaho Fish and Game has shut down the online license sales site where the breach occurred and it will remain shut down and will not be brought back up until an independent third party says it is safe to do so.
Can I still buy an Idaho hunting or fishing license and tag?
Yes, they are still available at about 400 businesses statewide and also at Fish and Game offices. The computer terminals used to sell licenses and tags at businesses and Fish and Game offices are separate from the online system.
What if I detect something suspicious with my accounts?
Call your local police department or sheriff’s office and file a report of identity theft. Get a copy of the police report. You may need to give copies of the report to creditors.