Florida FLHSMV breach exposes driver and vehicle records; extortion group publishes files

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) learned on September 4, 2026 that an international cybercriminal organization had accessed its systems using the credentials of a Plant City Police Department employee, which had been improperly stored on that employee's personal device. The access reached DAVID, the Driver and Vehicle Information Database that Florida law enforcement uses to look up driver and vehicle records. The department says the access was contained and the credentials were reset, and the Florida Digital Service and the Florida Department of Law Enforcement are investigating. The data potentially affected is driver license and motor vehicle data, including document images, and other personal information. The department reports no evidence of misuse so far, and it has published neither a confirmed count of affected people nor an exposure window.

The extortion group ShinyHunters added FLHSMV to its leak site on September 7, claiming more than 200,000 driver records taken from DAVID, and posted a screenshot of Jeffrey Epstein's DAVID record as proof; the screenshot's authenticity is unverified and the department has neither confirmed nor denied it. The group set a September 11 deadline, the state did not pay, and on September 16 the group published hundreds of thousands of files, claiming more than 500,000 files in total. TechCrunch reported on the publication and reviewed the leaked material. The department has not confirmed the group's counts, its separately claimed password reset flaw, or the authenticity of the published data, so every figure attributed to the group is an attacker claim.

On October 16, 2026 the department issued a public substitute notice because it lacks current mailing addresses for some impacted people, including former license and ID holders and people who previously titled a vehicle in Florida. Letters to potentially impacted current holders go out the week of October 19, offering one year of complimentary credit monitoring from Sontiq, a TransUnion company, and $1 million in identity theft insurance. Because the department has confirmed no total, this breach is listed with records pending and no figure is added to the records exposed total; the item will be updated when a confirmed count is published.

Sources: FLHSMV, September Security Incident notice; The Tallahassee Democrat; TechCrunch and BleepingComputer reporting on the group's leak site posts and the September 16 publication