US Customs and Border Protection says photos of thousands of travelers were stolen in a data breach

Hackers have stolen the photographs of travellers entering and leaving the US, as well as photos of their license plates, US Customs and Border Protection (CBP) has said.

The cyberattack was carried out on the network of a federal subcontractor, and the images were taken as part of a "malicious cyberattack". Although the hack attack has only just been revealed publicly, CBP first learned of it on May 31.

See also:

• Flipboard hacked -- attackers had access to database of user information for 9 months
• Google recalls Bluetooth version of Titan Security Key after discovering hacking vulnerability
• Hackers steal $40 million of Bitcoin from crypto exchange Binance

The agency says that the security incident played out over a period of a month and a half, and was limited to a "few specific lanes at a single land border". In total, CBP says that fewer than 100,000 people were affected, stressing that no travel documentation -- including passports -- was accessed.

In a statement, CBP said:

On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor's company network. The subcontractor’s network was subsequently compromised by a malicious cyber-attack. No CBP systems were compromised.

Initial information indicates that the subcontractor violated mandatory security and privacy protocols outlined in their contract. As of today, none of the image data has been identified on the Dark Web or internet. CBP has alerted Members of Congress and is working closely with other law enforcement agencies and cybersecurity entities, and its own Office of Professional Responsibility to actively investigate the incident. CBP will unwaveringly work with all partners to determine the extent of the breach and the appropriate response.

According to the Washington Post, the CBP has not named the affected entry port, nor the contractor, but the paper says:

But a Microsoft Word document of CBP's public statement, sent Monday to Washington Post reporters, included the name "Perceptics" in the title: "CBP Perceptics Public Statement".

The Register has linked this data breach to a previous security story involving Perceptics, leading to the conclusion that Santa Teresa or Columbus checkpoints were affected.

A review of the files in the May Perceptics leak reveals .TIF and .JPG files of vehicles passing through Santa Teresa and Columbus CBP checkpoints at the Mexican border in New Mexico.

At least a few hundred license plates, perhaps collected during a test, were leaked. MTF https://t.co/WkYA4IEfiM

— The Register (@TheRegister) June 10, 2019

Image credit: Rebekah Zemansky / Shutterstock