The Florida Department of Highway Safety and Motor Vehicles is publicly acknowledging one breach of the Driver and Vehicle Information Database (DAVID).
But questions remain as to whether that’s the only issue, according to published reports.
“On September 4, 2026, FLHSMV learned of a data breach conducted by an international cybercriminal organization. The data breach was quickly mitigated and no further breach has occurred or is ongoing. The Department immediately launched an investigation, which determined that a criminal actor was able to take advantage of a single Plant City Police Department user’s credentials that were improperly housed on the employee’s personal electronic device,” the department posted to social media this week.
That date is one day after Sept. 3, when the hacker group known as ShinyHunters said it accessed the data. Sources, including CSO Online, report that the ShinyHunters data set stemmed from a hack into the state of Florida’s systems via a password-reset weakness in the system, so the department’s statement corroborates that detail.
“In addition to providing the required notice of the security breach to the Office of the Attorney General pursuant to section 501.171, F.S., FLHSMV is partnering with the Florida Digital Service and the Florida Department of Law Enforcement in its response to the event. As this Is an ongoing criminal investigation, further information will be released at an appropriate time in the future,” the department added.
Florida Politics asked this week about what was included in the hacked data, whether the hack included gun license and medical marijuana records, what DHSMV plans to do about it and how citizens whose data was exposed will be protected. We did not get useful comment on that.
But more questions than answers remain, particularly since ShinyHunters issued a deadline of Sept. 11 to make a deal with them or else the data would be released.
DAVID is described by the state as “a multifaceted database that affords immediate retrieval of driver and motor vehicle information that is indispensable for law enforcement and criminal justice officials.”
In an ironic twist, criminals and lawbreakers now have access to the same personal identifying data, which could include pictures, addresses, dates of birth, vehicle identification numbers and other material that can be used to attack financial data and circumvent identity verification safeguards.
This is a separate breach from the set of 153 million driver’s licenses being shopped on the dark web, which the original source KrebsOnSecurity says was sourced from an identity verification company in Louisiana. The FBI is investigating that breach.
Other sources suggest a third intrusion into the system. We have reached out to the Department to get clarity on this account:
“Within roughly ten days, three distinct incidents surfaced involving driver credentials: the IDScan.net breach tied to the Nexus marketplace, a credential-theft breach of Florida’s DAVID law enforcement database, and now a separate hack of FLHSMV’s own systems that the agency says it detected on September 4 and has since contained. Each incident has a different cause, a different scope, and a different actor, but together they illustrate how fragile the pipeline of government-issued identity data has become,” reports Tech-Insider.Org.
“FLHSMV has not named the group responsible, has not disclosed how many records were affected, and has not detailed the attack vector. That is a meaningfully different disclosure posture than the agency took with the separate DAVID database breach, where it pointed to a specific, identifiable cause: credentials belonging to a Plant City Police Department employee that had been improperly stored on a personal device. The vaguer ‘international cybercriminal organization’ language leaves open the possibility that this incident involved a more sophisticated, financially motivated group operating outside U.S. jurisdiction, though the agency has offered no further attribution details,” Tech-Insider adds.
The state appears to have fumbled one recent opportunity to cure the glitch that left citizens wide open to exploitation.
Gov. Ron DeSantis proposed $16 million in the Fiscal Year 2025-26 budget for “Motorist Modernization” to “improve processes for motor vehicle licensing, business and customer support service and address legacy integration.” Lawmakers did not accommodate the request.
Florida has embraced technological innovation even as it has left sensitive data primed for exploitation. Florida Smart-ID was implemented earlier this decade, but pulled in 2024. The state allegedly has sought a new vendor but the app has not been replaced.
Florida Politics reached out to the Governor’s Office and Attorney General James Uthmeier for comment on this story, but have not yet heard back.
We also reached out to the gubernatorial campaigns of Byron Donalds and David Jolly, but they did not respond.