Florida DMV Database Breach Confirmed After Police Account Theft
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database was breached after the ShinyHunters extortion gang claimed responsibility for the incident. The group alleged that they accessed the database and stole more than 200,000 driver records.
On September 4, 2026, FLHSMV became aware of the breach, which was attributed to an international cybercriminal organization. In a statement, the agency noted that the breach was promptly addressed and that no ongoing threats were present.
Investigations revealed that the attackers gained access using compromised credentials from a single user at the Plant City Police Department. These credentials had been improperly stored on the employee's personal device, leading to the breach. FLHSMV has informed the Florida Office of the Attorney General and is collaborating with the Florida Digital Service and the Florida Department of Law Enforcement as part of their response.
The findings from FLHSMV differ from the claims made by ShinyHunters, which stated they exploited a password reset vulnerability to access multiple DAVID accounts, including those of DMV employees and an FBI agent. The hackers claimed to have started downloading records on September 3, prior to the agency's notification.
Evidence of Sensitive Data Exposure
As evidence of the breach, ShinyHunters shared a screenshot of a DAVID record belonging to Jeffrey Epstein, which contained sensitive personal and vehicle information. However, the group later indicated that they lost access to the system and believed the vulnerability was being patched.
FLHSMV has not disclosed the exact number of records accessed or stolen during the breach, nor has it confirmed the ShinyHunters' claim regarding the number of records taken. The agency has stated that further information will be released as the investigation progresses.
Final Assessment
As this situation develops, FLHSMV continues to work closely with law enforcement and digital service agencies to ensure that all necessary measures are taken to secure the database and prevent future breaches. The agency emphasizes the importance of safeguarding sensitive information and is committed to transparency as more details become available.
The breach of the DAVID database highlights the vulnerabilities that can arise from improper credential management and the ongoing threat posed by cybercriminal organizations. As investigations continue, FLHSMV is focused on enhancing security protocols to protect against similar incidents in the future.
