‘Pretty egregious conduct’: Attorney says WA DOL knew about massive data breach for 6 years, downplayed severity

Every Washington resident with a driver’s license or ID may have been exposed in a massive data breach that the Department of Licensing (DOL) knew about for six years, according to a local attorney.

Joel Ard, an attorney with Ard Law Group, is representing William Black, who filed a lawsuit against the DOL claiming the agency knowingly allowed a major security flaw in its License Express system, potentially exposing the personal information of every resident with a Washington license or state ID. Such an exposure could lead to severe consequences for residents, including stolen identities, stalking, and voter fraud.

“I’ve done some pretty big ones, but, boy, letting something stagnate for six years while you know it’s going on, that’s pretty egregious conduct,” Ard told “The John Curley Show” on KIRO Newsradio.

While several thousand Washington residents were notified by the DOL that they could be the victims of identity theft, Ard noted the agency minimized the severity of the situation.

“What they didn’t say was, ‘We know you’re the victim of identity theft, and we did it,'” Ard said.

“That sounds like a rather significant omission,” KIRO host Spike O’Neill said.

“Yeah, significant omission,” Ard responded. “The other thing is that state law actually requires any government agency in the state of Washington, when you know that something like this has happened, within 45 days, to notify the Attorney General’s Office. And you make a big public disclosure, and you tell everybody, ‘Hey, look out. This happened. Your data has been exposed. Look for possible adverse effects.’ They never did that either.”

The first red flag: DOL sends 50 to 75 licenses to an apartment, attorney says

The DOL opened an investigative file in early 2019 after the agency discovered its system was easily accessible to hackers, according to Ard.

“This was a DOL office in your living room, or, as it turns out, anybody’s living room. And somehow they built a system where somebody could figure out how to get in and access another person’s license information, change their address,” he explained.

Ard said the first tip was when the DOL noticed it sent 50 to 75 driver’s licenses to the same apartment in Puyallup, and they were all ordered by the same guy, with the same email address, and were all paid for by a burner visa.

“So it wasn’t very long that they figured out that, yes indeed, they were sending out batches, literally dozens or hundreds of licenses at a time to individual addresses,” Ard said.

He said the agency launched its online DOL system in September 2018 and that by 2019, it recognized hundreds of instances of obvious fraud.

“One of the reasons they decided not to follow state law and notification is that they didn’t fix the problem,” Ard explained. “And you hate to notify people. ‘Hey, by the way, your identity might be stolen, might be at risk, and still is. We’re just gonna leave it hanging out there in the wind.'”

Lawsuit in Chelan County could follow if DOL doesn’t respond

He noted the DOL took the entire system down in February 2025, and it appears the issue was fixed. But Ard is hopeful the Washington Attorney General’s Office will open an investigation.

“If they want to, if they want to dig in and fight and fight and fight, instead of finding a way to make Washington citizens whole, they’ve got a lot of resources to do that,” he said.

Ard said his team filed a tort claim with the DOL, which has 60 days to respond. If he doesn’t hear back, a lawsuit in Chelan County will follow.

Watch the full discussion in the video above.

Listen to John Curley weekday afternoons from 3 – 7 p.m. on KIRO Newsradio, 97.3 FM. Subscribe to the podcast here.

Follow @https://twitter.com/jcurleyshow