Tallahassee, September 13 — The Florida Department of Highway Safety and Motor Vehicles has confirmed that its Driver and Vehicle Information Database, known as DAVID, was breached, after the hacker group ShinyHunters claimed to have accessed the data on September 3. The department said in a social media post this week that on September 4 it learned of a data breach conducted by an international cybercriminal organization. It said the breach was quickly mitigated and that no further breach has occurred or is ongoing.
Under the hood, the technical reality is narrower than the headline. An investigation determined that a criminal actor took advantage of a single Plant City Police Department user’s credentials that were improperly housed on the employee’s personal electronic device.
That is a specific, identifiable cause, and it is the detail that matters: the entry point was a credential stored where it should not have been, not a flaw cracked open in the database itself.
A deadline, and a wall of silence
The department is partnering with the Florida Digital Service and the Florida Department of Law Enforcement in its response, and says that because this is an ongoing criminal investigation, further information will be released at an appropriate time. It has also provided the required notice of the security breach to the Office of the Attorney General pursuant to section 501.171, Florida Statutes.
Sources, including CSO Online, report that the ShinyHunters data set stemmed from a hack into the state of Florida’s systems via a password-reset weakness in the system, so the department’s statement corroborates that detail. Questions remain as to whether this is the only issue.
Florida Politics asked this week about what was included in the hacked data, whether the hack included gun license and medical marijuana records, what FLHSMV plans to do about it, and how citizens whose data was exposed will be protected. The publication reported that it did not get useful comment on those questions. More questions than answers remain, particularly since ShinyHunters issued a deadline of September 11 to make a deal with them or else the data would be released.
What DAVID holds, and who now holds it
DAVID is described by the state as a multifaceted database that affords immediate retrieval of driver and motor vehicle information that is indispensable for law enforcement and criminal justice officials. In an ironic twist, criminals and lawbreakers now have access to the same personal identifying data, which could include pictures, addresses, dates of birth, vehicle identification numbers and other material that can be used to attack financial data and circumvent identity verification safeguards.
This is a separate breach from the set of 153 million driver’s licenses being shopped on the dark web, which the original source KrebsOnSecurity says was sourced from an identity verification company in Louisiana. The FBI is investigating that breach.
Other sources suggest a third intrusion into the system. Tech-Insider.Org reported that within roughly ten days, three distinct incidents surfaced involving driver credentials: the IDScan.net breach tied to the Nexus marketplace, a credential-theft breach of Florida’s DAVID law enforcement database, and a separate hack of FLHSMV’s own systems that the agency says it detected on September 4 and has since contained.
Each incident has a different cause, a different scope, and a different actor, but together they illustrate how fragile the pipeline of government-issued identity data has become, according to Tech-Insider.Org. The report also noted that FLHSMV has not named the group responsible, has not disclosed how many records were affected, and has not detailed the attack vector.
That is a meaningfully different disclosure posture than the agency took with the separate DAVID database breach, where it pointed to a specific, identifiable cause: credentials belonging to a Plant City Police Department employee that had been improperly stored on a personal device. The vaguer international cybercriminal organization language leaves open the possibility that this incident involved a more sophisticated, financially motivated group operating outside U.S. jurisdiction.
What to watch next is the same thing that has been missing since the start: a record count, a named actor, and an attack vector. Until FLHSMV supplies them, the only confirmed fact about the scope of this breach is that it is still being described in the singular — one set of credentials, one personal device, one department.
