(The Center Square) – More than two weeks after a tort claim was filed against the Washington Department of Licensing (DOL) claiming the agency knowingly allowed a major security flaw in its data system and potentially exposed the personal information of Washingtonians, the agency has not yet formally responded.
Joel Ard, an attorney with Ard Law Group, who is representing William Black, said in his claim that the DOL knowingly allowed the major security flaw in its License Express system and failed to correct the issue for years.
“We really are hoping to hear from the Department of Licensing in less than sixty days,” he said. “If nothing else, to have them confirm that this back door indeed has been closed, which is our understanding, but they should know better than we do.
“That’s the more egregious part of this. They tried to hide it,” said Ard. “We brag and brag about how Washington has the best data privacy notice law in the nation, and it’s the first state to make that apply to government entities. And then you’ve got the state itself just ignoring the law.”
Ard told The Center Square several thousand Washington residents were notified by the DOL that they could be the victims of identity theft, but the severity of the issue was minimized and the attorney says DOL didn’t own the failure, nor correct it.
“It’s our understanding that the very first investigative file on this is dated 2019 and involves several hundred misdirected licenses,” he said. “It appears that the problem existed from Labor Day of 2018 to the second week of February, 2025.”
He told The Center Square DOL had routine batches of dozens or hundreds of licenses being redirected to a single address.
“They were paid for with burner visas, prepaid visas, and with random email addresses as the contact information,” Ard said. “The email address practically could have been johnsmithfraud@gmail.com….. just like really that blatant. And they knew it and they recognized it, but they never fixed the technical problem.”
DOL’s Digital Communications and Outreach Director Nathan Olson at DOL said there are looking into the claim.
“The Department of Licensing is reviewing the tort claim notice filed with Department of Enterprise Services on March 3, 2026,” wrote Olson in an email to The Center Square. “We found no evidence of a data breach through [DOL’s] License Express service. That service requires customers to input personal credentials (such as birth date and Social Security number, if applicable) before gaining access. DOL takes allegations of fraud seriously.”
Washington GOP Chairman Jim Walsh says the DOL had acknowledged the data breach, but it was worse than they thought.
“The lawsuit alleges the breach was both wide and deeper than we thought and the department knew about it and tried to kind of do damage control. I wouldn’t go so far as to save cover up, but it’s sort of like that,” Walsh said. “The agency later saying they knew about it sooner really puts them in a bad light. If the allegations are all right, they acted negligently.”
Ard said DOL opened an investigation in early 2019 after they discovered their system was easily accessible to hackers but failed to close the gaping hole. The flawed data system was shut down in early 2025.
“It’s the state government and your driver’s license is the key to every other use of your identity, so whatever excuse they have is insufficient,” Ard said.
On Friday, The Center Square received another email from DOL about the claim indicating they are still reviewing.
“We’re still looking into the claim,” wrote Olson with DOL. “I believe there’s a bit more than 40 days left for us to respond.”
Walsh told The Center Square; the data breach and allegations of identities being resold have much wider implications for voter rolls.
“How does that effect automatic voter registrations tied to those identities?” Walsh asked. “It’s very disturbing.”
