From Fox News · Kurt Knutsson, CyberGuy Report · · 4m
Florida DMV breach: what we know so far
Hackers say they took 200,000 Florida driver records. The state confirms a breach but tells a different story about how it happened.
In brief
Hackers say they took 200,000 Florida driver records. The state confirms a breach but tells a different story about how it happened. Florida has confirmed the breach but not its size, so act now: freeze your credit, lock down your email, and distrust any DMV message that asks you to verify details. Originally reported…
You cannot opt out
The DMV collects your address, birth date and license details because there is no alternative. That makes any breach of driver records worth paying attention to.
“Most of us hand over a lot of personal information to the DMV because we have no choice.”
Florida confirms the breach
The Florida Department of Highway Safety and Motor Vehicles says it learned of the incident on Sept. 4, moved quickly to contain it, and has seen no further unauthorized access.
Hackers claim 200,000 records
The extortion group ShinyHunters says it got into DAVID, Florida's Driver and Vehicle Information Database, and took more than 200,000 driver records.
The state has not confirmed the count
Florida has neither verified the 200,000 figure nor said publicly what information was taken. Two accounts are on the table and only one comes from the agency.
One officer's stored credentials
FLHSMV traced the intrusion to credentials belonging to a single Plant City Police Department user, improperly stored on that employee's personal device. A criminal actor then used them.
“A criminal actor was then able to take advantage of them.”
Who Florida told
The agency notified the Florida Office of the Attorney General as state law requires, and is working with the Florida Digital Service and the Florida Department of Law Enforcement.
The investigation is still open
The criminal investigation continues. Officials say more information will be released at an appropriate time, which means the public picture is incomplete.
An Epstein record as proof
BleepingComputer reported ShinyHunters supplied a screenshot of Jeffrey Epstein's DAVID record showing an address, Social Security number, birth date, license details and registered vehicles.
DAVID holds far more
Government records describing the system show authorized users may see driver photographs, signatures, vehicle history, insurance information and other identifying records.
Two stories about the way in
ShinyHunters told BleepingComputer it exploited a password-reset flaw to compromise multiple accounts, including DMV staff and an FBI agent. Florida points instead to those stolen police credentials.
The download and the patch
The group said it stepped through DAVID record IDs and pulled driver files starting Sept. 3, then lost access and believed the password-reset issue was being fixed.
Why this data is dangerous
Florida treats motor vehicle records as confidential because they can hold Social Security numbers, driver ID numbers, addresses and medical or disability information.
The scam gets convincing
Picture a caller claiming to be from a government agency who already knows your address, birth date and license number. The details are what make the pitch land.
“Suddenly, the scam sounds far more convincing.”
Other states may be next
A source told BleepingComputer attackers were working social engineering against DMV platforms in other states, and ShinyHunters said it expected more breaches to surface.
“If criminals find a technique that works against one government system, they often look for similar access elsewhere.”
ShinyHunters, briefly
The extortion crew has been tied to attacks on Salesforce environments and firms including Google, Cisco and Match Group, lately using voice phishing against IT support lines.
Florida will not name them
FLHSMV called the attacker only an international cybercriminal organization. The group claimed responsibility, but the state has not publicly attributed the breach to it.
Freeze credit, check reports
Place a free freeze separately at Equifax, Experian and TransUnion, then pull your reports at AnnualCreditReport.com and watch for small unfamiliar transactions.
Lock down your email
Your main inbox resets passwords everywhere else. Give it a strong unique password from a password manager and turn on multifactor auth, ideally an authenticator app or passkey.
Trust no DMV message
A confirmed breach is ready-made bait. Never click links in unexpected texts or emails about DAVID. Go to flhsmv.gov yourself, and report theft at IdentityTheft.gov.
“Do not automatically trust an email simply because it mentions DAVID or the Florida DMV.”
The one thing
Florida has confirmed the breach but not its size, so act now: freeze your credit, lock down your email, and distrust any DMV message that asks you to verify details.
