MIAMI, September 13 — The extortion group ShinyHunters says it pulled more than 200,000 driver records out of a restricted Florida state database, and the state has said nothing to confirm or deny it. The group added a listing titled “State of Florida DMV” to its dark web leak site on September 7, making the alleged breach public. As proof, it published a screenshot of Jeffrey Epstein’s motor vehicle record and gave state officials until September 11 to make contact.
That deadline has now passed. The Florida Department of Highway Safety and Motor Vehicles has not publicly acknowledged any intrusion, and federal authorities have stayed quiet.
That silence leaves the scale of the Florida DMV data breach resting on claims made by the attackers, who have an obvious interest in sounding credible. No independent review of the sample exists.
What the sample shows
According to ShinyHunters, the theft began on September 3 and produced more than 200,000 records before the group lost access. The proof sample centres on a single record belonging to Epstein. Visible fields include a home address, Social Security number, date of birth, and driver’s licence number.
Further tabs cover licence transactions, prior addresses, insurance details, previous vehicles, and parking permits. A name paired with a Social Security number and licence number gives a fraudster almost everything needed to open accounts under someone else’s identity.
Driver photographs and signatures raise the stakes further, because both support document forgery.
The technical reality
ShinyHunters describes a password-reset flaw as the entry point. The weakness let the group take over several accounts, which it says belonged to DMV staff and an FBI agent. Those accounts already held legitimate access, so the group needed no further exploitation.
From there, the method was mundane: the group stepped through record identifiers one by one, then saved the resulting pages and driver images. No malware, no zero-day, and no network intrusion appear anywhere in that account of events.
That detail points at a deeper authorisation problem. A restricted law enforcement platform should flag any account pulling tens of thousands of unrelated records in days. Rate limiting, query volume alerts, and per-user lookup auditing all exist for this scenario, but none of them interrupted the activity.
Inside DAVID
DAVID stands for Driver and Vehicle Information Database. Florida’s motor vehicle agency runs it as a lookup tool for police officers, prosecutors, and other criminal justice officials. The agency also describes the platform as its primary reporting mechanism for fatalities and serious bodily injury.
Systems built for law enforcement carry deeper records than a public licence renewal portal. DAVID can surface application documents, photographs, signatures, address history, vehicle history, and insurance records in one view.
Thousands of authorised users across the state reach that material daily. Broad internal access is the point of a system like DAVID, and it is also the risk. Once an attacker holds a valid account, the platform behaves exactly as designed.
The state agency has issued no statement acknowledging a compromise, and federal authorities have stayed quiet. The short countdown works against a careful response.
A state agency needs time to verify an intrusion, scope what data left its systems, and coordinate with federal investigators. Attackers set these deadlines precisely because that work cannot finish inside the window. Deadlines also function as theatre.
Extortion groups regularly extend them, negotiate quietly past them, or publish nothing at all. ShinyHunters says it expects to announce more DMV breaches over the coming weeks. Separate accounts describe social engineering attacks aimed at motor vehicle platforms in other states, so the Florida DMV data breach may have opened a wider campaign.
The detail that matters next is whether Tallahassee breaks its silence, and whether any other state agency finds its own DAVID logs telling a similar story.
