The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that hackers breached its systems, following claims from an extortion group that it stole more than 200,000 driver records from the state’s Driver and Vehicle Information Database, known as DAVID.
FLHSMV says it learned of the breach on Sept. 4, moved quickly to contain it, and has found no evidence of further unauthorized access. The agency has notified the Florida Office of the Attorney General as required by state law and is working with the Florida Digital Service and the Florida Department of Law Enforcement. The criminal investigation is ongoing.
The confirmation follows claims by the extortion group ShinyHunters, which told the outlet BleepingComputer it had accessed DAVID and pulled more than 200,000 driver records. As evidence, the group reportedly shared a screenshot of a DAVID record belonging to Jeffrey Epstein, showing an address, Social Security number, birth date, driver’s license information and registered vehicle details.
A Plant City Connection
According to FLHSMV, its investigation traced the intrusion to credentials belonging to a single Plant City Police Department user. Those credentials, the agency says, had been improperly stored on the employee’s personal electronic device, giving an attacker a way in.
That account differs from the version ShinyHunters originally gave. The group told BleepingComputer it exploited a password-reset flaw that let it compromise multiple accounts — allegedly including DMV employee accounts and an account belonging to an FBI agent — before working through DAVID record IDs to download driver files starting Sept. 3. ShinyHunters later said it lost access and believed the flaw was being patched.
FLHSMV has not confirmed the password-reset explanation. For now, that remains ShinyHunters’ account, while the compromised Plant City police credentials are the access method Florida has publicly acknowledged.
The agency also has not confirmed the 200,000-record figure or specified exactly what information was taken. In its public statement, FLHSMV referred to the attacker only as an
