DC Residents Beware: The DDOT Data Breach Exposed 311,893 SSNs and Driver’s Licenses

In November 2024, residents of Washington DC faced a serious privacy threat when the District Department of Transportation (DDOT) suffered a major data breach. An open directory misconfiguration on a DDOT server left a 309MB CSV file fully exposed, containing the sensitive personal records of over 311,000 individuals. The presence of Social Security Numbers and driver's license data makes this one of the more consequential public sector breaches of the year, with immediate and long-term identity theft risks for those affected.

Why This DDOT Breach Is Especially Dangerous

Most data breaches expose email addresses or phone numbers. This one goes much further. Social Security Numbers and driver's license numbers are the twin keys to identity fraud in the United States. Armed with both, a criminal can open lines of credit, file fraudulent tax returns, impersonate victims to government agencies, or sell the data in bulk on dark web marketplaces. The fact that this data came from a government transportation agency -- which may hold records on individuals involved with or interacting with DC systems -- adds further risk for those who may not even know their data was stored there.

What Was Exposed

• First and last names
• Dates of birth and gender
• Social Security Numbers (SSNs)
• Driver's license numbers and issuing states
• Phone numbers
• Home addresses, cities, states, and ZIP codes
• Occupations and employer names
• Geographic coordinates
• Person IDs and Crime IDs (internal identifiers)

Why This Matters

The combination of SSNs, driver's license numbers, and full biographical data creates a complete identity profile that criminals can exploit in multiple ways:

• Identity theft: Open fraudulent accounts, loans, or credit cards using victims' SSNs and personal details.
• Tax fraud: File false tax returns to redirect refunds before the real taxpayer files.
• Synthetic identity fraud: Combine real SSNs with fabricated names to create entirely new fraudulent identities.
• Phishing and social engineering: Use names, phone numbers, and employer data to craft highly convincing targeted attacks.
• Account takeover: Leverage personal details to bypass security questions and identity verification at financial institutions.

How Open Directory Breaches Work

An open directory breach occurs when a server or cloud storage bucket is misconfigured to allow public access without authentication. In this case, DDOT's server had a directory listing enabled, meaning anyone who discovered the URL could browse and download files directly -- no hacking required. This class of vulnerability is entirely preventable with basic security hygiene: proper access controls, regular configuration audits, and automated scanning for exposed assets. Unfortunately, it remains one of the most common causes of large-scale government data exposures.

Check If You Are Affected

If you have ever interacted with DC government transportation services or believe your information may have been held by DDOT, you should act immediately. Use the HEROIC breach search tool -- powered by a database of over 400 billion compromised records -- to check whether your personal information appears in known data breaches. Early detection is your best defense against identity fraud.