The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that there has been a data breach in its DAVID driver database after extortion gang ShinyHunters claimed to have compromised the system.
The revelation came after extortion group ShinyHunters claimed it had hacked the DAVID database and stolen more than 200,000 driver records.
“On September 4, 2026, FLHSMV learned of a data breach by an international cybercrime organization,” the agency said in a Bank statement sent to X.
“The data breach was quickly mitigated and no further breach has occurred or is ongoing.”
FLHSMV says its investigation determined that the attacker used compromised credentials from a single user of the Plant City Police Department that were improperly stored on the employee’s personal electronic device.
The agency says it has notified the Florida Attorney General’s Office of the breach and is working with the Florida Digital Service and the Florida Department of Law Enforcement as part of its response.
“As this is an ongoing criminal investigation, further information will be released in due course,” FLHSMV said.
ShinyHunters claimed a different access method
FLHSMV’s findings differ from those that ShinyHunters previously claimed to have gained access to the database.
The hackers claimed they exploited a password reset flaw to gain access to several DAVID accounts, including accounts belonging to DMV employees and an FBI agent.
ShinyHunters said it began looping through DAVID record IDs and downloading associated HTML pages and images starting September 3.
As evidence of the breach, the threat actors shared a screenshot of a DAVID record belonging to Jeffrey Epstein that contained sensitive personal and vehicle information.
ShinyHunters later told BleepingComputer that it had lost access to the system and believed the bug was being fixed.
FLHSMV has not disclosed how many records were accessed or stolen during the breach and has not confirmed ShinyHunters’ claim that more than 200,000 records were stolen.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL and Atlassian for a two-hour digital summit to learn what attacks are changing at AI speed, what defenders should give up, and how to validate, decide, fix and re-validate at machine speed.
