The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed a data breach of DAVID, the state's Driver and Vehicle Information Database, after the ShinyHunters extortion group listed the agency on its leak site and claimed theft of more than 200,000 driver records. FLHSMV says it learned of the intrusion on September 4, 2026, describes the attacker as "an international cybercriminal organization," and states the breach "was quickly mitigated and no further breach has occurred or is ongoing." Critically, the agency has not confirmed the 200,000 figure, has not said what data was taken, and its account of how the attackers got in differs materially from the one the criminals told reporters. The 200,000 number is a ShinyHunters claim carried by BleepingComputer, Fox News, NBC News and others; no state source has validated it.
What Happened
The public timeline runs backward from the criminals to the state. On the night of September 7, ShinyHunters added "State of Florida DMV" to its dark-web leak site, threatening to publish files if FLHSMV did not negotiate. NBC News, which viewed the site, reports the extortion deadline was set for September 11. BleepingComputer first reported the claim on September 8, including the group's assertion that it had pulled over 200,000 records.
Florida initially declined to confirm anything. On Friday, September 11, FLHSMV posted a statement to X and its website acknowledging the breach and dating its own discovery to September 4, three days before the leak-site listing and a day after ShinyHunters says its scraping began. The agency notified the Florida Office of the Attorney General as required under state breach law and says it is working the response with the Florida Digital Service and the Florida Department of Law Enforcement. FLHSMV has said only that "as this is an ongoing criminal investigation, further information will be released at an appropriate time in the future." Florida Politics similarly reports the agency acknowledging an ongoing criminal investigation with no further detail.
The single hard technical fact the state has released is the entry point: compromised credentials belonging to one Plant City Police Department user, improperly stored on that employee's personal electronic device. Tech-Insider attributes the identification of Plant City specifically to reporting by Tampa Bay 28, layered on top of FLHSMV's narrower written statement.
What Was Taken
Accounts here diverge sharply, and the honest answer is that the scale is unresolved.
ShinyHunters claims more than 200,000 driver records. FLHSMV has confirmed neither the count nor the categories of data accessed. Every outlet in this set that carries the 200,000 figure attributes it to the threat actor, not to the state, and sfl.media notes explicitly that "what remains unresolved is the scale of the theft and exactly what information the attackers obtained."
What is known about DAVID's contents comes from the proof sample rather than a state disclosure. ShinyHunters published a screenshot of the DAVID record for Jeffrey Epstein, which per BleepingComputer contained address, Social Security number, date of birth, driver's license ID, issuance and expiration dates, and registered vehicles. The platform also exposes tabs for license transactions, address history, insurance, prior vehicles and parking permits. That is the shape of the per-record blast radius if the claimed volume is real. ShinyHunters described its collection method as iterating through DAVID record IDs and downloading the associated HTML pages and images starting September 3, a technique that, if accurate, means whatever was pulled is full record pages rather than a partial field export.
One further limiting detail: ShinyHunters later told BleepingComputer it had lost access and believed the flaw it used was being patched, which is consistent with FLHSMV's "quickly mitigated" language even though the two sides disagree on what the flaw was.
Why It Matters
DAVID is not a consumer-facing DMV portal. It is the law enforcement lookup system, described by FLHSMV itself as affording "immediate retrieval of driver and motor vehicle information that is indispensable for law enforcement and criminal justice officials" and serving as the primary reporting mechanism for Fatalities and Serious Bodily Injury records. Access is federated out to municipal police departments across the state, which means the security boundary of a state database of driver PII is only as strong as credential hygiene at the smallest agency holding a login. In this case, per the state's own finding, that was one employee at one municipal department with a login sitting on a personal device.
The timing compounds it. NBC News notes this is the second organization holding Americans' driver's license data breached in September 2026, following IDscan.net, a vendor that scans licenses for private companies, where attackers claimed 160 million IDs including one belonging to Defense Secretary Pete Hegseth, prompting federal investigation. NBC reports the two incidents do not appear related, but together they describe an actor set that has decided identity-document repositories are a priority target. Driver record data does not expire the way payment card data does; address, DOB and license number are durable inputs for synthetic identity fraud, SIM swaps and account recovery attacks for years.
There is also a targeting dimension defenders should not miss. The proof of concept ShinyHunters chose was a high-profile individual's record. A law enforcement lookup system with arbitrary record-ID enumeration is a surveillance tool as much as a PII dump, useful for locating specific people by address and vehicle.
The Attack Technique
Two accounts are on the table and they are not reconcilable as stated.
FLHSMV's account, which as the victim's own investigative finding carries the most weight here: an attacker obtained the DAVID credentials of a single Plant City Police Department user that had been improperly stored on that employee's personal electronic device, and used them to access the system. This is a credential-compromise story about endpoint and credential-storage policy, not a platform vulnerability. Tech-Insider makes the point directly: FLHSMV "is not describing a platform-wide vulnerability."
ShinyHunters' account, given to BleepingComputer before the state spoke: the group exploited a password-reset flaw that let it take over multiple DAVID accounts, including accounts belonging to DMV employees and an FBI agent, then enumerated record IDs to harvest pages. That is an authentication-logic vulnerability story with a far wider potential exposure than one stolen login.
BleepingComputer, Fox News and sfl.media all flag the discrepancy rather than resolving it. It is possible both are partially true, for instance, an initial credential compromise used to reach a reset function abusable against other accounts, but no source in this set establishes that, and it should be treated as speculation. What defenders can act on: the two hypotheses call for different controls, and until Florida says more, prudent posture is to assume both a credential-hygiene failure and an account-recovery weakness are live risks in comparable systems.
What Organizations Should Do
- Audit credential storage on personal devices for any federated or partner-agency user. The confirmed root cause was a login stored off agency-issued hardware. Policy prohibiting this is common; enforcement and detection are not. Inventory which external users hold accounts in your sensitive lookup systems and validate how those credentials are held.
- Require phishing-resistant MFA on law enforcement and partner-tier accounts. A stolen static credential should not be sufficient for access to a database of driver PII. FIDO2/WebAuthn removes the value of the exact artifact that was compromised here.
- Harden and test password-reset and account-recovery flows. ShinyHunters' claimed path was a reset flaw enabling multi-account takeover. Recovery flows are routinely excluded from authentication testing scope. Include them, and alert on reset events for privileged accounts.
- Rate-limit and alert on sequential record-ID access. The claimed exfiltration was ID enumeration against record pages. Per-account volumetric thresholds, plus detection for monotonic ID traversal, would have surfaced this within hours rather than days.
- Treat every partner agency login as an inbound attack path and scope it down. Apply least privilege by query type and volume, expire dormant partner accounts aggressively, and require re-attestation of the roster from each participating department.
- Pre-stage breach notification and regulator workflows. FLHSMV notified the state Attorney General under statutory obligation while the scope of what was taken remained unknown. Assume you will have to disclose before you know the record count, and have the language and legal path ready.
- For Florida drivers specifically: with no confirmation of scope, assume exposure. Place a credit freeze rather than relying on monitoring alone, and treat any unsolicited contact referencing license or vehicle details as a fraud attempt.
Sources: DMV breach confirmed as hackers claim 200,000 records stolen – Inte... | Florida confirms DMV database breached via stolen police account | ShinyHunters hackers claim breach of Florida "DAVID" DMV database | Florida DMV says it was hacked shortly after major driver’s license... | Florida DMV data breach confirmed after ShinyHunters steals records... | Florida Driver License Database Hacked: ShinyHunters Claims More Th... | FLHSMV acknowledges 'ongoing criminal investigation ... | FLHSMV Confirms Plant City Login Behind DMV Breach