Florida traces the DAVID driver database breach to one Plant City police account
FLHSMV says the way into DAVID was a single Plant City Police Department account whose credentials sat on a personal device, while ShinyHunters says it got in through a password reset flaw. The state has not put a number on the records taken.
The Watch · Security desk
What happened
- FLHSMV said it learned on September 4, 2026 of a data breach of its DAVID driver database conducted by what it called an international cybercriminal organization.
- The gang says it then iterated through DAVID record IDs starting September 3, downloading the HTML page and images associated with each record.
- Florida has not said how many records were accessed and has not confirmed the gang's claim that more than 200,000 driver records were taken.
Why it matters
- What doesn't add up contradiction The two accounts imply different fixes: revoking one account and enforcing device policy at a municipal department, or repairing an authentication flow the gang says was still being patched.
- What it limits constraint Without a record count from FLHSMV, drivers judging their own exposure have only an extortion group's number to work from.
- What's now possible capability Sequential record-ID retrieval means one valid session converts into a bulk dataset, so login controls carry the whole defence.
Next story · Product · Oct 1
Pentagon breach exposes the job specialties of 2.8 million current and former personnelConfirmed2 publishers
Iterating record IDs and saving the HTML behind each one is the part of this that both sides describe the same way. ShinyHunters says it started that on September 3, pulling the page and the images for each DAVID record it walked past [6]. That step requires no exploit, only a valid session and a system that will answer a few hundred thousand sequential lookups.
The stories split on how the session was obtained. FLHSMV says its investigation found compromised credentials belonging to a single Plant City Police Department user, improperly stored on that employee's personal electronic device [3]. ShinyHunters says it abused a password reset flaw to take over multiple DAVID accounts, among them DMV employees and an FBI agent [12]. The two accounts describe different entry points [13]. One is a credential left where an attacker could take it; the other is a defect in the state's authentication flow.
The dates are close together. Bulk downloading began on September 3 by the gang's own account [6], and FLHSMV said it learned of the breach on September 4, 2026 [2], a gap of one day [10]. ShinyHunters later told BleepingComputer that it had lost access and believed the flaw was being patched [9].
"The data breach was quickly mitigated and no further breach has occurred or is ongoing," the agency said in the statement it posted to X [8]. It has not said how many records the attacker reached, and it has not confirmed the gang's claim of more than 200,000 driver records [15]. So the only figure in public is the extortion group's [14]. The proof it offered was a screenshot of the DAVID record for Jeffrey Epstein, carrying personal and vehicle details [7].
DAVID logins sit outside the agency that owns the data. On Florida's own account, credentials issued to a city police department user were enough to reach driver records [3], and ShinyHunters says the accounts it controlled included an FBI agent's [12]. Anyone holding a DAVID login holds a route into the state's driver file [11], and the security of that file depends in part on how one municipal department's staff store their passwords.
FLHSMV has notified the Florida Office of the Attorney General and says it is working with the Florida Digital Service and the Florida Department of Law Enforcement [4]. "As this is an ongoing criminal investigation, further information will be released at an appropriate time in the future," FLHSMV said [5].
What to watch
- A record count from FLHSMV, or a breach notification filed with the Florida Attorney General that puts a number on driver exposure.
- Any documented change to DAVID's password reset flow, which would support the gang's account of entry over the agency's.
- Whether access restrictions or device rules are imposed on Plant City Police Department and other outside agencies holding DAVID logins.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that its DAVID driver database suffered a data breach after the ShinyHunters extortion gang claimed to have compromised the system.
- [2]
"On September 4, 2026, FLHSMV learned of a data breach conducted by an international cybercriminal organization," the agency said in a statement posted to X.
- [3]
FLHSMV says its investigation determined that the attacker used compromised credentials belonging to a single Plant City Police Department user that had been improperly stored on the employee's personal electronic device.
- [4]
FLHSMV says it has notified the Florida Office of the Attorney General of the breach and is working with the Florida Digital Service and the Florida Department of Law Enforcement as part of its response.
- [5]
"As this is an ongoing criminal investigation, further information will be released at an appropriate time in the future," FLHSMV said.
- [6]
ShinyHunters said it began iterating through DAVID record IDs and downloading associated HTML pages and images beginning on September 3.
- [7]
As proof of the breach, the threat actors shared a screenshot of a DAVID record belonging to Jeffrey Epstein that contained sensitive personal and vehicle information.
- [8]
"The data breach was quickly mitigated and no further breach has occurred or is ongoing."
- [9]
ShinyHunters later told BleepingComputer that it had lost access to the system and believed the flaw was being patched.
- [10]
One day separates the start of bulk downloading claimed by ShinyHunters (September 3) from the date FLHSMV says it learned of the breach (September 4, 2026).
- [11]
DAVID account holders extend beyond FLHSMV staff: the agency names a Plant City Police Department user, and the gang claims accounts belonging to DMV employees and an FBI agent.
- [12]
ShinyHunters claimed it exploited a password reset flaw to gain access to multiple DAVID accounts, including accounts belonging to DMV employees and an FBI agent.
- [13]
The agency's account and the gang's account describe incompatible entry routes: one credential taken from a personal device versus takeover of multiple accounts through a password reset flaw.
- [14]
ShinyHunters claimed it breached the DAVID database and stole more than 200,000 driver records.
- [15]
FLHSMV has not disclosed how many records were accessed or stolen during the breach and has not confirmed ShinyHunters' claim that more than 200,000 records were taken.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFlorida confirms DMV database breached via stolen police account
1 article · September 11, 2026
- therecord.mediaFlorida says motor vehicle data breach tied to credentials stolen from officer’s personal device
1 article · September 11, 2026
Topics and entities
Topics
- Credential security
- Data Breaches
- Government Cybersecurity
Entities
- Florida Department of Law Enforcement
- ShinyHunters
- Florida Highway Safety and Motor Vehicles
- Plant City Police Department
- Florida Digital Service