Florida DMV breach confirmed; hackers claim 200,000 driver records stolen

Florida's Department of Highway Safety and Motor Vehicles confirmed on September 15 that its driver database had been breached. The agency, known as FLHSMV, discovered the intrusion into its DAVID system—the Driver and Vehicle Information Database—on September 4 and moved quickly to contain it. No further unauthorized access has occurred since, officials said, but the damage was already done. An extortion group calling itself ShinyHunters claims to have stolen more than 200,000 driver records, complete with Social Security numbers, addresses, birth dates, and vehicle registration details.

The breach matters because it exposes the kind of information most people have no choice but to hand over to government agencies. A driver's license file contains far more than just a photo and an address. The DAVID system holds photographs, signatures, vehicle histories, insurance information, and other identifying data that authorized government users can access. In the wrong hands, this material becomes a toolkit for identity theft and fraud. A criminal armed with someone's address, birth date, Social Security number, and driver's license information can impersonate them with alarming credibility—calling a bank, applying for credit, or convincing someone they represent a government agency.

Florida's investigation traced the breach to credentials belonging to a single employee of the Plant City Police Department. Those credentials had been improperly stored on the employee's personal electronic device, where a criminal actor was able to access and exploit them. This explanation differs sharply from what ShinyHunters has claimed. The group initially told security researchers that it breached DAVID through a password-reset vulnerability, one that allegedly allowed it to compromise multiple accounts belonging to DMV employees and even an FBI agent. ShinyHunters said it then moved through the database systematically, downloading driver records beginning September 3, until it lost access as the flaw was being patched. Florida has not backed that account. For now, the password-reset story remains the hackers' version; the compromised police credentials are what the state has publicly identified as the actual entry point.

What remains unclear is nearly as important as what has been confirmed. Florida has not disclosed how many records were actually accessed or stolen, nor has it confirmed ShinyHunters' claim of 200,000 records. The agency has not specified what information was taken—whether all records contained Social Security numbers, or only some. ShinyHunters provided a screenshot of a record belonging to Jeffrey Epstein as proof of access, showing an address, Social Security number, birth date, driver's license information, and vehicle details. But without Florida's full accounting, the true scope of the breach remains unknown.

ShinyHunters is not a new threat. The extortion operation has been linked to attacks on Salesforce environments and major companies including Google, Cisco, and Match Group. More recently, the group has relied on voice phishing—impersonating IT support to trick employees into entering credentials or authentication codes into fake websites. They have targeted single sign-on accounts connected to Microsoft 365, Google Workspace, and Salesforce. The fact that they were able to exploit a single compromised credential to access a state DMV system underscores a broader vulnerability: once an attacker obtains legitimate access, other connected services may become accessible too.

Florida has notified the state Attorney General as required by law and is working with the Florida Digital Service and the Department of Law Enforcement. The criminal investigation is ongoing. Officials said additional information would be released at an appropriate time, but that time has not yet come. In the meantime, residents whose records may have been exposed face a waiting period filled with uncertainty. The breach creates an opening for scammers to send fake alerts claiming to be from FLHSMV, pressuring people to verify personal information or click malicious links. Security experts recommend that affected drivers freeze their credit with the three major bureaus, monitor their credit reports and bank accounts for suspicious activity, and be extremely skeptical of any unsolicited messages claiming to be from the DMV. The possibility that ShinyHunters or other attackers might use the same techniques against DMV systems in other states adds another layer of concern. If a method works against one government database, criminals often look for similar vulnerabilities elsewhere.