Florida officials have confirmed a data breach affecting the state's Department of Highway Safety and Motor Vehicles (FLHSMV), which manages driver and vehicle records.
The confirmation follows claims made by the ShinyHunters extortion group that it had accessed the Florida Driver and Vehicle Information Database (DAVID) and stolen more than 200,000 driver records. The FLHSMV stated it learned of the incident on September 4, took immediate steps to mitigate it, and has not detected further unauthorized access.
Florida's investigation has traced the breach to credentials belonging to a single user from the Plant City Police Department, which were reportedly stored improperly on the user's personal electronic device. This criminal actor then allegedly exploited those credentials.
ShinyHunters, however, previously told the cybersecurity news outlet BleepingComputer that it breached DAVID through a password-reset flaw, compromising multiple accounts, including those of DMV employees and an FBI agent. The group claimed it then downloaded driver files starting September 3. Florida has not corroborated the password-reset flaw claim, and the investigation into the exact method of access is ongoing.
The DAVID database holds sensitive personal information, including driver's license details, photographs, signatures, vehicle history, and insurance information. This type of data can be valuable to criminals for identity theft and sophisticated scams. The FLHSMV has not yet disclosed the exact number of records compromised or confirmed the specific types of information stolen.
The agency has notified the Florida Office of the Attorney General and is cooperating with the Florida Digital Service and the Florida Department of Law Enforcement on the criminal investigation. Officials have indicated that more information will be released when appropriate.
ShinyHunters is an operation linked to various data theft attacks, including those against Salesforce environments, Google, Cisco, and Match Group. The group has also employed voice phishing, or vishing, tactics, impersonating IT support to trick employees into revealing credentials.
While Florida has confirmed a breach, it has not publicly named ShinyHunters as the perpetrator, referring to the attacker only as an "international cybercriminal organization."
As a precaution, individuals are advised to take steps to protect themselves from potential identity theft. These measures include freezing credit reports with the three major credit bureaus (Equifax, Experian, and TransUnion), regularly reviewing credit reports for suspicious activity, and being vigilant against phishing attempts or unsolicited communications that claim to be from the DMV. It is recommended to always visit official government websites directly rather than clicking on links in suspicious emails or texts.
Experts also advise using strong antivirus software, protecting primary email accounts with robust passwords and multi-factor authentication, and monitoring financial accounts for any unusual transactions. Reducing the amount of personal information available through data brokers and people-search websites can also help limit the data available to criminals.