The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that an attacker got into its Driver and Vehicle Information Database (DAVID). DAVID is the system that police and criminal justice officials use to look up driver and vehicle records across the state. The agency is now mailing breach letters to potentially affected license and ID card holders. It announced this in a release sent at 5:23 p.m. EDT on Friday, October 16, more than a month after it first admitted the breach. FLHSMV still has not said how many people are affected. The ShinyHunters extortion group claims it stole more than 200,000 driver records (BleepingComputer). TechCrunch, which reviewed a copy of the leaked data, describes hundreds of thousands of files. The agency and the attackers also give different accounts of how the attackers got in.
What Happened
ShinyHunters says it began working through DAVID records on September 3, 2026 (BleepingComputer). FLHSMV says it learned of the breach on September 4. Its October notice says a "malicious actor accessed certain department records on September 4, 2026, using compromised credentials." It is not clear whether the activity started on the 3rd or the 4th. The agency's account does not mention any activity on September 3.
On September 7, ShinyHunters added FLHSMV to its data leak site and threatened to publish the data unless the agency negotiated. As proof, the group shared a screenshot of the DAVID record for Jeffrey Epstein (BleepingComputer, The Record). According to The Record, FLHSMV ignored repeated press inquiries that week. It then confirmed the breach in a post on X on the night of September 11. The agency blamed an unnamed "international cybercriminal organization" and said it had notified the Florida Office of the Attorney General. It also said it was working with the Florida Digital Service and the Florida Department of Law Enforcement.
On September 16, TechCrunch reported that ShinyHunters had published the stolen files "because the victim did not pay a ransom or cooperate and comply." FLHSMV did not respond to TechCrunch about the leak.
The agency said nothing more publicly until October 16. That day it published a notice on its website, issued a statewide news release, and announced that letters would go out "this week." Florida Politics called the timing a "Friday news dump."
What Was Taken
Different sources describe the data differently, and the volume has never been confirmed.
- FLHSMV (official notice): Potentially affected data includes "driver license and motor vehicle data, to include document images, and other personal information." No count has been disclosed.
- ShinyHunters (claim, via BleepingComputer): More than 200,000 driver records, collected as HTML pages and images pulled from DAVID.
- TechCrunch (review of leaked data): Hundreds of thousands of certificate-of-title records containing the names and addresses of vehicle buyers and sellers, plus VINs. A smaller set of files included Social Security numbers, non-U.S. passports and immigration papers. TechCrunch said the files did not appear to include driver's licenses or people's photos.
- The Epstein proof record (BleepingComputer): This shows what a full DAVID record contains: address, SSN, date of birth, license number, issue and expiry dates, and registered vehicles. It also has tabs for license transactions, address history, insurance, prior vehicles and parking permits.
FLHSMV says "document images" were involved. TechCrunch says the leak did not appear to contain license images. These two accounts have not been reconciled. The agency also says it has "no evidence indicating that information has been misused." That statement should be read alongside TechCrunch's report that the data has been publicly posted on a leak site since mid-September.
Notification covers current license and ID holders by mail. FLHSMV is also issuing substitute notice under Section 501.171, Florida Statutes. That notice is for former license or ID holders and past Florida vehicle title holders, whose mailing addresses the agency may not have. This suggests the affected group goes beyond current drivers, which fits with TechCrunch's finding of title records. Affected people are offered one year of identity and credit monitoring through Sontiq, a TransUnion company, with $1 million in identity theft insurance.
Why It Matters
DAVID is a law enforcement lookup system. It brings together identity, address history and vehicle data on a huge share of Florida residents. When one credential for that kind of system is compromised, an attacker can harvest records in bulk, not just view one person's file. It was also exposed to the large number of local agencies and users who have access to it. FLHSMV's own explanation is that one small-city police user's login was the way in. That makes third-party access by partner agencies the weak point.
The incident also fits a wider pattern. In the same month, the IDScan breach exposed more than 150 million driver's license images (TechCrunch, The Record). The Record notes that some researchers first suspected the two incidents were linked, and that ShinyHunters had earlier tried to buy the IDScan data. No confirmed link has been reported. The Record also places this attack within ShinyHunters' recent extortion campaign, which it says included Jack Henry and McKesson. Together, leaked license, title and SSN data provide ready material for identity fraud, synthetic identities and targeted social engineering.
The disclosure process itself is worth noting. The agency confirmed the breach only after the attackers went public. It gave out no details on scope for five weeks. It then announced notification late on a Friday. Victims had no official guidance during the period when their data was already circulating.
The Attack Technique
The two accounts of initial access conflict, and neither has been independently verified.
- FLHSMV's account: "A criminal actor was able to take advantage of a single Plant City Police Department user's credentials that were improperly housed on the employee's personal electronic device." The October notice simply says "compromised credentials." The agency reports that it blocked the unauthorized access, reset the relevant credentials, brought in outside security professionals and added safeguards.
- ShinyHunters' account (to BleepingComputer): The group says it exploited a password-reset flaw in DAVID. It claims this let it take over multiple accounts, including accounts belonging to DMV employees and an FBI agent. It says it then enumerated sequential record IDs and scraped the HTML and images for each record. The group later said it had lost access and believed the flaw was being patched.
Florida Politics describes the breach as happening "through a password-reset weakness" while the agency calls it compromised credentials. However, that outlet is not independently confirming the flaw. FLHSMV has not publicly addressed the password-reset claim. The two versions are not necessarily incompatible, since a weak reset process could be what turns one stolen credential into several hijacked accounts. Still, the sources do not settle the question. Whichever version is right, the scraping that followed points to missing rate limits and missing anomaly detection on bulk record access.
What Organizations Should Do
- Harden password-reset flows on high-value portals. Require phishing-resistant MFA as part of any reset. Send reset notices to a second channel. Add rate limits. Alert on resets for privileged or law enforcement accounts.
- Enforce phishing-resistant MFA and device posture for partner-agency users. Credentials stored on unmanaged personal devices should not be enough on their own to reach a statewide records system.
- Detect enumeration and bulk retrieval. Set per-user query baselines. Alert on sequential record-ID access and on unusually high page or image download volumes. Throttle sessions automatically when they cross thresholds.
- Audit and minimize third-party access. Regularly review which outside agencies and individual users can query sensitive databases. Limit each user to the record types and volumes their job requires.
- Plan disclosure before an incident. Prepare notification templates, substitute-notice procedures under state law, and a public communication timeline. That way, confirmation does not wait on the attacker's leak site.
- Warn affected users about follow-on fraud. Fake breach letters and phishing that uses leaked addresses and VINs are likely. Tell people how to verify official mail, and push credit freezes, not just monitoring.
Sources: Weeks after data breach, FLHSMV says it will let drivers ... | Florida confirms DMV database breached via stolen police account | Florida says motor vehicle data breach tied to credentials stolen f... | ShinyHunters hackers claim breach of Florida "DAVID" DMV database | Hackers publish thousands of drivers' data after breaching Florida... | September Security Incident | Public Notice Regarding September Security Incident | FLHSMV Data Breach Letters Are Going Out: What Florida Drivers Shou...