TALLAHASSEE, September 11 — The Florida Department of Highway Safety and Motor Vehicles has been named on a cybercriminal leak site, after the group ShinyHunters claimed it breached DAVID, the Driver and Vehicle Information Database, and stole records belonging to more than 200,000 drivers. The claim was posted on 7 September, with ShinyHunters adding FLHSMV to its data leak site. According to reporting by BleepingComputer, the intrusion reportedly began on 3 September.
As of writing, neither FLHSMV nor the FBI had publicly confirmed the full scope of the breach or the exact number of affected individuals beyond ShinyHunters’ own claim.
The password-reset problem
ShinyHunters told BleepingComputer it gained access to DAVID through a password-reset weakness, which allowed the group to compromise multiple accounts. That is the detail that matters here. If confirmed, it points to a relatively low-complexity attack vector for a breach of this magnitude — no zero-day, no exotic malware, just a reset flow that let an attacker move between accounts.
DAVID is operated by FLHSMV to help law enforcement officials retrieve details related to a particular driver. It is, in other words, a system built for exactly the kind of sensitive personal data that makes a breach costly.
To substantiate its claim, ShinyHunters released a screenshot of a record belonging to Jeffrey Epstein, the late financier who remains a fixture in news coverage. The released record included his address, Social Security number, birth date, driver’s licence ID, issuance and expiration dates, and registered vehicles, as reported by BleepingComputer. The message posted on the leak site read: “Contact us, you know how.
Or we will release the files.”
A credential you cannot reset
Danny Jenkins, CEO of ThreatLocker, said a driver’s licence is a “master key” to identity. Consumers have been conditioned to view a driver’s licence as a safe and trusted way to prove their identity, he noted, but every scan creates another permanent copy of a credential that cannot simply be reset after a breach. That is the technical reality of identity data.
A password can be changed. A Social Security number and a licence ID cannot.
The incident adds to a series of data breaches attributed to ShinyHunters, a group that has repeatedly claimed responsibility for high-profile intrusions. The pattern is familiar — claim, leak-site post, a sample record to prove the point — and it keeps working. The story is developing.
Further details about the breach’s impact and the response from Florida authorities are expected. Watch for confirmation from FLHSMV on the scope of the exposure, and for any indication of whether the password-reset weakness has been closed.
