Security2 publishers2 min readPublished
Florida traces the DAVID driver database breach to one Plant City police account
FLHSMV says the way into DAVID was a single Plant City Police Department account whose credentials sat on a personal device, while ShinyHunters says it got in through a password reset flaw. The state has not put a number on the records taken.
The Watch · Security desk
What happened
- FLHSMV said it learned on September 4, 2026 of a data breach of its DAVID driver database conducted by what it called an international cybercriminal organization.
- The gang says it then iterated through DAVID record IDs starting September 3, downloading the HTML page and images associated with each record.
- Florida has not said how many records were accessed and has not confirmed the gang's claim that more than 200,000 driver records were taken.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- contradiction The two accounts imply different fixes: revoking one account and enforcing device policy at a municipal department, or repairing an authentication flow the gang says was still being patched.
- constraint Without a record count from FLHSMV, drivers judging their own exposure have only an extortion group's number to work from.
- capability Sequential record-ID retrieval means one valid session converts into a bulk dataset, so login controls carry the whole defence.
Iterating record IDs and saving the HTML behind each one is the part of this that both sides describe the same way. ShinyHunters says it started that on September 3, pulling the page and the images for each DAVID record it walked past [9]. That step requires no exploit, only a valid session and a system that will answer a few hundred thousand sequential lookups.
The stories split on how the session was obtained. FLHSMV says its investigation found compromised credentials belonging to a single Plant City Police Department user, improperly stored on that employee's personal electronic device [5]. ShinyHunters says it abused a password reset flaw to take over multiple DAVID accounts, among them DMV employees and an FBI agent [8]. The two accounts describe different entry points [13]. One is a credential left where an attacker could take it; the other is a defect in the state's authentication flow.
The dates are close together. Bulk downloading began on September 3 by the gang's own account [9], and FLHSMV said it learned of the breach on September 4, 2026 [3], a gap of one day [14]. ShinyHunters later told BleepingComputer that it had lost access and believed the flaw was being patched [11].
"The data breach was quickly mitigated and no further breach has occurred or is ongoing," the agency said in the statement it posted to X [4]. It has not said how many records the attacker reached, and it has not confirmed the gang's claim of more than 200,000 driver records [12]. So the only figure in public is the extortion group's [2]. The proof it offered was a screenshot of the DAVID record for Jeffrey Epstein, carrying personal and vehicle details [10].
DAVID logins sit outside the agency that owns the data. On Florida's own account, credentials issued to a city police department user were enough to reach driver records [5], and ShinyHunters says the accounts it controlled included an FBI agent's [8]. Anyone holding a DAVID login holds a route into the state's driver file [15], and the security of that file depends in part on how one municipal department's staff store their passwords.
FLHSMV has notified the Florida Office of the Attorney General and says it is working with the Florida Digital Service and the Florida Department of Law Enforcement [6]. "As this is an ongoing criminal investigation, further information will be released at an appropriate time in the future," FLHSMV said [7].
What to watch
- A record count from FLHSMV, or a breach notification filed with the Florida Attorney General that puts a number on driver exposure.
- Any documented change to DAVID's password reset flow, which would support the gang's account of entry over the agency's.
- Whether access restrictions or device rules are imposed on Plant City Police Department and other outside agencies holding DAVID logins.