The Florida Department of Highway Safety and Motor Vehicles has confirmed that its DAVID driver and vehicle database was breached, after the ShinyHunters extortion gang listed the agency on its leak site and published a screenshot of Jeffrey Epstein's Florida driver record, Social Security number included, as proof of access. The agency says it learned of the intrusion on September 4, 2026, mitigated it quickly, and has seen no ongoing access. What it has not confirmed is the scale: ShinyHunters claims more than 200,000 driver records, a figure Florida has neither validated nor countered with one of its own. The two sides also give materially different accounts of how the attacker got in, and that disagreement has not been resolved publicly.
What Happened
The timeline assembled across reporting runs roughly like this. ShinyHunters says it began iterating through DAVID record IDs and downloading the associated HTML pages and images on September 3 (BleepingComputer). FLHSMV says it learned of the breach on September 4. Hoodline reports the gang listed the State of Florida DMV on its dark web leak site on September 7, with a September 11 negotiation deadline; BleepingComputer's first story ran September 8, and CSO Online confirmed the same deadline on September 9.
FLHSMV did not respond to press inquiries through that week, according to The Record, then publicly confirmed the breach on the evening of Thursday, September 11. Its statement, posted to X, said an "international cybercriminal organization" was responsible, that "the data breach was quickly mitigated," and that "no further breach has occurred or is ongoing." The agency has notified the Florida Office of the Attorney General as required and is working with the Florida Digital Service and the Florida Department of Law Enforcement. It has declined to release numbers, citing the ongoing criminal investigation.
No payment followed. On September 16, TechCrunch reported that ShinyHunters had published the stolen files, with the gang saying it did so "because the victim did not pay a ransom or cooperate and comply" with its demands.
DAVID is worth understanding precisely here. It is not the public-facing license renewal portal. It is the Driver and Vehicle Information Database, the back-end lookup system used by law enforcement and criminal justice officials, described by FLHSMV itself as "indispensable" and as the primary reporting mechanism for fatalities and serious bodily injury. A single DAVID record can tie a legal name to an address, license number, date of birth, photograph, and signature in one view, with tabs for license transactions, address history, insurance, prior vehicles, and parking permits.
What Was Taken
Accounts differ substantially, and the difference matters.
ShinyHunters claims more than 200,000 driver records, a figure repeated consistently across BleepingComputer, CSO Online, Fox News, and Hoodline, and always attributed to the gang. Florida has not confirmed that count or said what categories of data were accessed. Fox News notes explicitly that the state has neither validated the 200,000 figure nor described what was taken.
The most concrete independent look at the actual dump comes from TechCrunch, which reviewed a copy of the leaked data. Its description does not match the "driver records" framing. TechCrunch found hundreds of thousands of certificates of vehicle ownership containing buyer and seller names and addresses along with vehicle identification numbers. A smaller subset included Social Security numbers and other government-issued documents such as non-U.S. passports and immigration paperwork. Notably, TechCrunch reported the published files did not appear to contain driver's licenses or driver photographs.
So the honest summary is: the gang advertises 200,000+ driver records, the published corpus as examined by TechCrunch reads more like a large volume of title and ownership documents with a minority of high-sensitivity identity documents mixed in, and the state has published no count at all. Anyone citing a single clean number for this incident is picking one.
The Epstein record itself is the exception, fully described and clearly high-fidelity. BleepingComputer and CSO Online report the sample screenshot showed address, Social Security number, date of birth, driver's license ID, issuance and expiration dates, and registered vehicles. Hoodline, citing Cyber Magazine, adds photograph and signature to that list, and reports the sample matched the standard DAVID user interface layout. Epstein is deceased, which is precisely why he was chosen: maximum publicity, minimum immediate victim harm to the gang's negotiating position. It was a credibility device, and it worked.
Why It Matters
Three things make this incident more consequential than its headline record count.
First, the compromised asset is a law enforcement query system, not a consumer database. Access to DAVID is access to the tool police use to identify people. That is a surveillance capability in the wrong hands, useful for locating individuals, validating stolen identities against authoritative state data, and building convincing synthetic identity packages. CSO Online's framing is correct: a complete record scan gives criminals far more than an identification number.
Second, the intrusion path ran through a downstream municipal user, not the state agency itself. By FLHSMV's own account, one credential belonging to one employee of the Plant City Police Department, a small suburb outside Tampa, was sufficient. Every state-level system with a federated municipal user base inherits the weakest device hygiene policy of its smallest participating agency.
Third, the presence of immigration paperwork and non-U.S. passports in the dump, per TechCrunch, raises the harm profile well beyond ordinary identity theft for an already vulnerable population.
Context on the actor: The Record notes ShinyHunters recently claimed attacks on bank IT provider Jack Henry and on McKesson, which told regulators data was stolen from its oncology and surgical business units. This is a group operating at a sustained tempo against high-value data custodians.
One clarification worth making, because early coverage conflated them. The Record reports that when the DAVID claims first surfaced, some researchers suspected a link to the separate IDScan identity-verification breach involving roughly 153 million driver's license scans, sold through an underground service CSO Online identifies as Nexus and now under FBI investigation. ShinyHunters had reportedly tried to buy that database from the hackers behind it. The two incidents are close in time and thematically similar, but no source establishes that they are the same operation. Treat them as separate until proven otherwise.
The Attack Technique
This is where the record openly conflicts, and neither version has been independently verified.
ShinyHunters told BleepingComputer it exploited a password-reset flaw in the DAVID platform to compromise multiple accounts, including accounts it claimed belonged to DMV employees and, in its telling, an FBI agent. It then queried records by sequential ID and bulk-downloaded the resulting pages and images. The gang later told BleepingComputer it had lost access and believed the flaw was being patched.
FLHSMV's investigation reached a different conclusion. Per the agency statement carried by BleepingComputer, The Record, Fox News, and Hoodline, "a criminal actor was able to take advantage of a single Plant City Police Department user's credentials that were improperly housed on the employee's personal electronic device." Startup Fortune notes that local station WCTV reported the same credential-on-personal-device detail. This is the PRIMARY account and carries the most weight, but it is also the account that minimizes the state's own platform liability, and the agency has released no evidence for it.
The two stories are not strictly incompatible. Stolen credentials for one valid account could plausibly have been the foothold used to reach and abuse a password-reset function that then yielded additional accounts. No source confirms that reconciliation, and it should be treated as a hypothesis, not a finding. What defenders can take as established: valid credentials were used, the access supported high-volume enumeration of records by ID, and detection appears to have come at least partly after the fact.
What Organizations Should Do
-
Audit password-reset and account-recovery flows on every privileged internal application. Self-service reset is the most commonly under-tested authentication surface in government and enterprise portals. Verify that reset tokens are single-use, short-lived, bound to the requesting session, and not guessable or enumerable, and that reset does not bypass MFA enrollment.
-
Enforce phishing-resistant MFA on any system that returns PII at scale, with no exception for federated municipal or partner users. A credential stored on a personal device should not by itself be sufficient for access to a law enforcement lookup system. This is the single control that would most likely have blunted the confirmed access path.
-
Instrument bulk-access detection, not just login anomaly detection. The described attack, iterating sequential record IDs and downloading pages and images, produces an unmistakable behavioral signature: high query volume, sequential identifier patterns, and off-profile access times from a single account. Rate-limit per account, alert on volumetric deviation from an individual user's baseline, and cap daily record retrieval.
-
Inventory and govern your downstream user population. If external agencies or partners hold accounts on your system, you own their access hygiene whether or not you own their devices. Require attestation on device policy, enforce managed-device or conditional access where possible, and set aggressive credential rotation and inactivity expiry for external accounts.
-
Randomize or tokenize record identifiers. Sequential, guessable record IDs turn a single valid session into a full-database scrape. Non-enumerable identifiers plus per-record authorization checks convert bulk exfiltration into a far slower and noisier operation.
-
Pre-plan your disclosure posture. FLHSMV went several days without responding to press while the gang controlled the narrative, and it still has not published a record count. Whatever the investigative justification, the practical result was that the attacker's 200,000 figure became the number everyone used. Have a communications track that can state scope, or state explicitly why scope is not yet known, within the first news cycle.
Sources: Hackers Prove Florida DMV Breach by Leaking Jeffrey Epstein's Drive... | Florida confirms DMV database breached via stolen police account | Florida says motor vehicle data breach tied to credentials stolen f... | ShinyHunters hackers claim breach of Florida "DAVID" DMV database | ShinyHunters claims Florida DMV breach, puts data on the clock | Hackers publish thousands of drivers' data after breaching Florida ... | Florida DMV data breach confirmed after ShinyHunters steals records... | Florida DMV Breach Traced to Plant City Officer