The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed a breach of its DAVID driver database, triggered by compromised credentials from a police department employee's personal device.

  • The DAVID driver database was compromised by an international cybercriminal organization.
  • Attackers used credentials belonging to a Plant City Police Department employee stored on a personal device.
  • The extortion group ShinyHunters claims over 200,000 records were exfiltrated.

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has officially confirmed a significant data breach involving its DAVID driver database. The breach came to light after the notorious extortion gang, ShinyHunters, claimed to have compromised the system and stolen sensitive driver records. The agency first detected the intrusion on September 4, 2026.

According to the agency's internal investigation, the breach was not the result of a sophisticated system-wide hack but rather a failure in credential management. The attackers gained entry using compromised credentials belonging to a single employee of the Plant City Police Department. Crucially, these credentials had been improperly stored on the employee's personal electronic device, providing a direct gateway for the criminals.

Read Also:iRobot Promo Code: Massive Discounts on Roomba Robot Vacuums and Accessories

Why This Matters

BozokMedia analysis shows that this incident underscores a critical vulnerability in public sector cybersecurity: the intersection of professional access and personal device usage. When high-level administrative access is stored outside of secured corporate environments, it bypasses traditional perimeter defenses. This breach highlights the urgent need for mandatory Multi-Factor Authentication (MFA) and strict Zero Trust architectures across all state agencies.

"The human element remains the weakest link in the security chain; a single unsecured password on a personal phone can compromise millions of citizens' data."

There is a notable discrepancy between the official government narrative and the claims made by the hackers. While FLHSMV points to stolen credentials, ShinyHunters asserts they exploited a password reset flaw to access multiple accounts, including those of DMV staff and an FBI agent. The group claimed to have iterated through record IDs to download HTML pages and images starting September 3.

To validate their claims, the threat actors released a screenshot of a record belonging to Jeffrey Epstein, showcasing sensitive personal and vehicle information. While FLHSMV has not confirmed the exact volume of stolen data, the hackers insist that over 200,000 records were successfully exfiltrated before the vulnerability was patched.

Did You Know?: The DAVID system is a centralized database used by law enforcement across Florida to access driver and vehicle information in real-time.

Frequently Asked Questions

Q1: How did the hackers enter the system?
A: They used compromised login credentials that were improperly stored on a police employee's personal electronic device.

Q2: Who is investigating the breach?
A: The FLHSMV is working with the Florida Office of the Attorney General, the Florida Digital Service, and the Florida Department of Law Enforcement.