FLHSMV discovers breach of driver records after September 4 intrusion

Over 200,000 driver records were stolen from Florida’s Driver and Vehicle Information Database (DAVID), the hacking group ShinyHunters claimed, and FLHSMV said a malicious actor accessed the system on September 4, 2026, with compromised credentials. To back up its claim, ShinyHunters posted a screenshot of Jeffrey Epstein’s record, which showed address, SSN, birthdate, driver license information, and registered vehicles. ShinyHunters asserted it breached DAVID through a password-reset flaw that allowed it to compromise multiple accounts, allegedly including DMV employees and an FBI agent.

FLHSMV said it took immediate steps to contain the breach and secured its systems. The agency also said there is no evidence of misuse of the accessed data. ShinyHunters is described as an extortion gang that targets online web applications and cloud-based software-as-a-service environments, using tactics such as voice phishing and stolen authentication tokens.

ShinyHunters posted the alleged breach on their leak site and gave Florida a deadline of September 11, 2026, to negotiate a fee to prevent the data from being released. After FLHSMV published its statement on September 11, ShinyHunters removed references to Florida from the leak site.

ShinyHunters said they have since lost access to DAVID and believe the password-reset issue is being patched. FLHSMV notified the Florida Office of the Attorney General as required by state law and is working with the Florida Digital Service and the Florida Department of Law Enforcement on the investigation.

The FBI is investigating a separate breach of IDscan.net (a company that provides driver-license scanning technology) (a firm that sells scanner hardware and software for reading driver licenses) after claims that 160 million identification documents (IDs such as driver licenses) were stolen.

FLHSMV is sending letters to current Florida driver license or ID holders (people who hold a Florida driver license or identification card) (people who have a state-issued driver license or identification card) whose data may have been affected by the breach. The agency noted it may lack current contact information (up-to-date mailing addresses or e-mail addresses) (mailing addresses or e-mail addresses on file) for many former Florida residents whose data resided in the system. FLHSMV provided an e-mail address for individuals to inquire about whether their information was potentially exposed (a way for the public to ask questions) (a public inbox for breach-related inquiries).

FLHSMV recommended that affected persons monitor their financial accounts (bank and credit card accounts) (checking, savings, and credit-card accounts), review their credit reports (records of borrowing history) (summaries of loan and payment history), and consider placing a fraud alert (a notice that warns creditors to verify identity) (a flag that prompts lenders to take extra verification steps) or security freeze (a lock that prevents access to credit reports) (a block that stops new credit from being opened in the consumer’s name) with major credit bureaus to protect against identity theft. FLHSMV partnered with Sontiq Inc. (a provider of identity protection services) to offer one year of complimentary identity and credit monitoring (services that watch for signs of fraud) (ongoing surveillance of credit files and personal data for suspicious activity) that includes up to $1 million in identity theft insurance (coverage that helps pay for costs related to recovering from identity theft) (a policy that covers expenses such as legal fees and lost wages).