The suit says the Department of Licensing knew about the alleged flaw but did not notify millions of Washington drivers.
THURSTON COUNTY, Wash. — A proposed class-action lawsuit filed Wednesday alleges the Washington State Department of Licensing left an online security flaw open for years, allowing identity thieves to change addresses and order replacement licenses.
The lawsuit was filed in Thurston County Superior Court by William Black and Bess Byers.
Black filed a tort claim in March accusing the DOL of leaving what the claim described as a security “back door” in its License eXpress system. The lawsuit says more than 60 days passed after the claim was presented to the state Department of Enterprise Services Office of Risk Management.
The lawsuit repeats many of the allegations from the March tort claim and adds Byers as a named plaintiff.
The complaint centers on License eXpress, an online system the DOL launched in 2018 for driver licensing services. The lawsuit says the system contained personal information for people with Washington driver’s licenses or IDs, including names, Social Security numbers, birth dates, license numbers, addresses and photographs.
According to the lawsuit, one part of the system, called “No Logon,” allowed people to use online services without creating an account or signing in. The complaint says a person needed only information such as a driver’s license number, name and date of birth.
The lawsuit alleges that allowed someone to access another person’s driver record, change the address and order a replacement license or ID card to be mailed to the new address. The complaint says the DOL website advertised that residents could “replace online without creating an account.”
The complaint says the fraud was often obvious because dozens or hundreds of replacement licenses were sent to the same address, sometimes using the same email address for multiple orders.
The DOL assigned the issue to its Driver and Vehicle Investigations Unit, according to the lawsuit. The complaint says an early case involved 300 to 400 victims and that the DOL later sought help from the Washington State Patrol as the number of cases grew.
By 2020 or early 2021, more than 1,000 successful thefts had already occurred, according to the complaint. The lawsuit says licenses were often sent in batches to a single King County apartment, and when investigators checked one address, deliveries stopped there and moved elsewhere.
The lawsuit alleges the DOL knew about the issue for years but did not fix it. The complaint says that in or around 2024, the Washington State Patrol told the DOL that hundreds of new cases a month were too many to handle unless the DOL addressed the flaw.
The complaint says the DOL closed the old No Logon path in February 2025.
The lawsuit also accuses the DOL of failing to notify everyone whose information may have been exposed.
Byers alleges she realized in March 2020 that she had been the victim of identity theft. The complaint says people unknown to her took out loans in her name, made online purchases and applied for new credit cards using her information.
The lawsuit also says Byers did not receive her primary election ballot in August 2020 or her general election ballot that November. She later got a call saying a ballot envelope had been rejected because of a signature issue, even though she said she voted in person.
Black alleges he was never notified by the DOL that his personal information had been exposed. The complaint says his information was used to apply for unemployment benefits around 2019 while he was still working for the Chelan County Sheriff’s Office.
The proposed class includes Washington residents whose driver’s license information was allegedly compromised through License eXpress. The lawsuit also proposes a subclass for people who suffered documented financial losses from identity theft.
When reached for comment after the March tort claim, the DOL sent KING 5 the following response:
“The Department of Licensing is reviewing the tort claim notice filed with Department of Enterprise Services on March 3, 2026. DOL disputes the allegation of widespread fraud and has found no evidence of a data breach through its License Express service. That service requires customers to input personal credentials, such as birth date and Social Security number, if applicable, before gaining access. DOL takes allegations of fraud seriously.”
The Washington State Patrol also sent KING 5 News a statement after the tort claim was filed:
“In August 2019, WSP was asked to investigate suspected fraudulent use of DOL’s License Express System. The investigation pursued evidence of identity theft. This was not regarding a data breach. However, in September 2021, WSP investigators informed DOL the case was closed because of a lack of active leads.”
To ensure diverse coverage and expert insight across a wide range of topics, our publication features contributions from multiple staff writers with varied areas of expertise.
