“CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network,” the agency said. The incident last a month and a half and involved “fewer than 100,000 people,” according to a CBP spokesperson.