Her contractor license number had been used to pull permits in three counties for projects she had never set foot on.
The small business owner held a state contractor license required for her residential window and door replacement business. The license was valid, her record was clean, and her license number appeared in the state contractor registry that any member of the public could search. That registry entry was the only source the actor needed.
Permit applications filed in her name across three counties described renovation projects at addresses she had never visited. Each permit was granted because the license number was valid and her compliance history showed no violations. By the time a building inspector flagged an inconsistency in one of the projects, her license number was already attached to construction work she had not authorized, in jurisdictions where she had never held a job.
The remediation path runs through the state licensing board, the building departments of each affected county, and any civil proceedings arising from the work performed under her credential. Each jurisdiction handles its own permit records, and the licensing board handles its own inquiry. There is no single coordinating authority managing the full scope of the correction. A small business owner working through this sequence while maintaining an active client schedule is running two tracks simultaneously, and one has no defined end date.
The license number in the public registry was not a security failure. It was a filing requirement. The structural gap is that a publicly indexed credential number, with no additional verification step required, was sufficient to represent a licensed contractor in a government permit process. Every licensed trade professional whose license number appears in a searchable state database carries the same exposure. Understanding how permit systems verify license authority, and what additional signals would flag a submission as unauthorized, is not information the registry provides.
Strong passwords won't protect a business that's exposing the wrong information. Most Small Business Owners are solving the wrong problem. The RuleDraft Small Business Isolation Manual helps you identify the exposures passwords were never designed to fix.