Your Driver Application Is a Data Breach Waiting to Happen

Does a small carrier's website really need this level of protection?

Short answer: if it hosts your driver application, yes, because that form legally has to collect exactly the combination of data that triggers a mandatory breach notification in every single US state. This isn't about your dispatch software or your ELD. It's about the public-facing form that any visitor can reach, sitting on the same website your marketing content lives on, collecting some of the most sensitive personal information a small business handles.

Why is a driver application form actually a cybersecurity target?

Because of what it's legally required to contain. Under 49 CFR 391.21, a compliant CDL driver application has to collect the applicant's Social Security number, driver's license information, and years of employment and driving history. This isn't optional data a carrier chooses to ask for. It's a federal requirement, which means every carrier's application form, whether it lives on a modern site or a ten-year-old WordPress install, is a concentrated store of exactly the kind of personal information attackers look to steal.

Compare that to a typical small business contact form, which might collect a name and an email address. A driver application form collects the raw materials for identity theft, all in one submission, often with far less security investment behind it than the carrier's internal systems get.

How do attackers actually get at data submitted through a website form?

A few common paths, none of which require sophistication:

• ★Outdated content management software. If a carrier's site runs on WordPress, a very common choice for small business websites, WordPress sites accounted for the large majority of infected websites cleaned by security firm Sucuri in a recent year, and the overwhelming majority of the underlying vulnerabilities were in plugins and themes, not the core software itself. An unmaintained plugin on an otherwise fine website is a common way in.
• ★Stolen credentials. Across breaches generally, stolen credentials were the single most common way attackers gained initial access, cited in 22% of cases in the 2025 Verizon Data Breach Investigations Report. A reused or weak password on the account that manages the website or its form submissions is a direct path to the data behind it.
• ★Unsecured form storage or email forwarding. Some website builders store form submissions in a dashboard with weak or no access controls, or forward every submission to a plain email inbox, meaning years of applicant SSNs and license numbers sit wherever that inbox's security happens to be.
• ★No encryption in transit or at rest. A form that isn't served over a properly configured HTTPS connection, or that stores submissions in an unencrypted database, exposes that data to interception or straightforward extraction if the underlying system is compromised.

What happens legally if that data leaks?

Every US state, along with the District of Columbia, Guam, Puerto Rico, and the Virgin Islands, has a data breach notification law requiring companies to notify affected individuals when personal information, commonly defined as a name combined with a Social Security number or driver's license number, is exposed. That's the exact combination a CDL application collects.

These laws differ in their specifics (some require notifying a state attorney general, some set different timelines, some apply additional requirements like free credit monitoring when an SSN is involved), but the baseline obligation is consistent: if a carrier's driver application data is exposed, notifying every affected applicant, likely across multiple states given how driver recruiting works, isn't optional. It's a legal requirement layered directly on top of whatever damage the breach itself causes.

What does a breach like this actually cost?

IBM's Cost of a Data Breach Report puts the global average cost of a data breach at $4.44 million, and the US average considerably higher, at $10.22 million. Those figures come from IBM's full research sample, which includes large enterprises, so they're not a literal prediction for a small carrier. But they illustrate the scale of what a breach involving regulated personal data can trigger: notification costs across potentially dozens of states, legal review, credit monitoring offers, reputational damage with drivers who trusted the application with their SSN, and in some cases regulatory penalties on top of the notification requirement itself.

What can carriers actually do to secure it?

None of this requires an enterprise security budget, but it does require treating the driver application form as sensitive infrastructure, not just a marketing page with a form embedded in it:

• ★Keep the website platform and every plugin or theme updated, since outdated add-ons, not the core platform, are where most real-world compromises happen.
• ★Use a dedicated, strong, unique password with multi-factor authentication for whatever account manages the website and its form submissions, since stolen credentials remain the single most common way in.
• ★Confirm where form submissions actually go and how they're stored. If applicant data lands in a plain email inbox or an unsecured dashboard, that's the weak point, regardless of how secure the rest of the site is.
• ★Verify the form is served over HTTPS and that stored submissions are encrypted, not just assumed to be handled securely by whatever platform built the site.
• ★Know your state notification obligations before you need them, since figuring out the requirements for the first time during an actual incident costs time you won't have.