Possible data exposure for hunting and fishing license online sales system
Information belonging to customers who purchased hunting or fishing licenses from the FWD website may have been accessed improperly. Although there is no conclusive evidence of a misuse of customer information, security monitoring by the company which manages the website, bolstered by 3rd party forensics audits, have found traces of unauthorized server access occurrences in 2015 and January 2016. This has prompted the Fish & Wildlife Department to notify seven (7) customers of potential exposure of their credit card number. The department also urges customers who have purchased licenses online in the past 14 months to be vigilant and monitor their financial reports as an extra precaution. Free credit reports are available if consumers are concerned about possibly suspicious activity on their cards.
Although credit card information is not stored in the online license system, in seven (7) instances (out of almost 1.6 million transactions) it appears that customers who entered their credit card number into a wrong field during the purchase process could have had their credit card number subject to theft. In these seven cases, the customer records which had the potential for exposure did not include expiration dates or credit card codes necessary to process a transaction, lessening any risk of improper use.
After both an internal examination by the State of Vermont, and the completion of two external consultant reviews, there is no conclusive evidence of any misuse of customer information. However, although the reviews found no traces of any successful attempt to breach the customer system, the most recent examination by consultant Security Metrics found traces of an unauthorized accessing of some customer information. In an abundance of caution, and in order to ensure its valued customers have the information necessary to protect themselves, the Department is reaching out to the public as well as to seven specific customers after consultation with the Vermont Attorney General's Office and the Vermont Department of Information and Innovation.
"The results of the forensics audit provide no clear evidence that customers' information has been compromised, but in the interests of full disclosure we wanted to make sure the public knew the results of the most recent security review of the system were not definitive," said Louis Porter, commissioner of the Vermont Fish & Wildlife Department. "Those who purchase licenses are not only our valued customers, they also play an essential role in managing wildlife populations, and in ensuring that wild animals, birds and fish remain a part of the State of Vermont into the future."
The system is managed, monitored and is continually upgraded to improve security by Vermont-based web design and development company, Earthlogic. "Earthlogic has operated by industry best practices and has managed this problem professionally and responsibly at all times," said Glenn Schoonover, Chief Security Officer for the State of Vermont. "In fact, it was their internal defense system that first detected that there may be a vulnerability."
"The credit card information of hunting, fishing or trapping license customers is much more likely subject to theft due to malware on their home computers than due to vulnerabilities in the license purchasing system," Schoonover said.
"We are very pleased with the results of the three independent 3rd party security audit reports," said Chris Kesler, President of Earthlogic. "Security is our top priority. To that end we run industry best security protocols and adhere to security best practices to ensure customer information is secure at all times. We feel the results of these audits validate our approach to ecommerce security."
If customers are in any way concerned about purchasing through the Fish & Wildlife Department online license system, they can buy licenses from agents located in many convenience stores, sporting goods stores and other locations. Those stores have not been implicated in any of the concerning activity.
Below is a check list of suggestions of how to best protect yourself against identity theft:
1. Review your bank, credit card and debit card account statements over the next twelve to twenty-four months and immediately report any suspicious activity to your bank or credit union.
2. Monitor your credit reports with the major credit reporting agencies.
• Equifax, 1-800-685-1111, P.O. Box 740241, Atlanta, GA 30374 0241, www.equifax.com
• Experian, 1 888 397 3742, P.O. Box 2104, Allen, TX 75013, www.experian.com
• TransUnion, 1 800 916 8800, P.O. Box 2000, Chester, PA 19022, www.transunion.com
Under Vermont law, you are entitled to a free copy of your credit report from those agencies every twelve months.
Call the credit reporting agency at the telephone number on the report if you find:
• accounts you did not open,
• inquiries from creditors that you did not initiate, or
• inaccurate personal information, such as home address and Social Security number.
3. If you do find suspicious activity on your credit reports or other account statements, call your local police or sheriff's office and file a report of identity theft. Get a copy of the police report. You may need to give copies of the police report to creditors to clear up your records, and also to access some services that are free to identity theft victims.
4. If you find suspicious activity on your credit reports or on your other account statements, consider placing a fraud alert on your credit files so creditors will contact you before opening new accounts. Call any one of the three credit reporting agencies at the number below to place fraud alerts with all of the agencies.
5. You may also get information about security freezes by contacting the credit bureaus at the following addresses:
If you do not have Internet access but would like to learn more about how to place a security freeze on your credit report, contact the Vermont Attorney General's Office at 802-656-3183 (800-649-2424 toll free in Vermont only).
6. Even if you do not find suspicious activity on your credit report or your other account statements, it is important that you check your credit report for the next two years. Just call one of the numbers in paragraph 2 above to order your reports or to keep a fraud alert in place. Helpful information about fighting identity theft, placing a security freeze, and obtaining a free copy of your credit report is available on the Vermont Attorney General's website at:
Another helpful source is the Federal Trade Commission website, available at http://www.ftc.gov/bcp/edu/microsites/idtheft/.
Printed moose hunting applications available, deadline to apply is July 12
Vermont moose hunting permit applications are on the Vermont Fish & Wildlife Department's website (www.vtfishandwildlife.com), and now printed applications are also available at license agents statewide.
A total of 135 regular moose season permits and 25 archery moose season permits will be issued for Vermont's 2016 October moose hunt. The regular season will be Oct. 15-20, and the archery season is Oct. 1-7.
The number of permits are reduced from last year in ten Wildlife Management Units, and permits will be for bulls-only in all WMUs except B, C and E1.
The 160 permits being issued represent a 40 percent decrease from the number of permits issued last year. Hunters are expected to harvest close to 70 moose.
"We recommended a reduction in permit numbers and a continuation of bulls-only permits in most of the units this year based on biological data, and our population estimates indicating moose densities remain below management goals in many areas," said wildlife biologist Cedric Alexander, Vermont's moose project leader. "The intent of the proposal is to allow population growth in most of Vermont.
Alexander estimates Vermont has over 2,000 moose statewide with the greatest concentration in the Northeast Kingdom.
Lottery applications are $10 for residents and $25 for nonresidents. The deadline to apply is July 12. Winners of the permit lottery will purchase resident hunting permits for $100 and nonresident hunting permits for $350. Hunters also will have the option to bid on five moose hunting permits in an auction to be announced later.
Hunters who had a permit in 2013, 2014 or 2015 are not eligible to apply for a permit or buy a bonus point in 2016.