Florida confirms DMV database breached via stolen police account
Florida DMV database breached by ShinyHunters using stolen police credentials.
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach of its DAVID driver database, allegedly by the ShinyHunters extortion gang. Attackers gained access using compromised credentials belonging to a Plant City Police Department employee, which were improperly stored on a personal device. While ShinyHunters claimed to have stolen over 200,000 records and exploited a password reset flaw, FLHSMV stated the breach was mitigated and is investigating.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FLHSMV?
Get an email when a new story names FLHSMV, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers gained access to Florida's DAVID driver database by compromising credentials belonging to a law enforcement employee, which were improperly stored on a personal device — a clear violation of credential hygiene and device management policies. This breach highlights the cascading risk of granting third-party or partner agency accounts access to sensitive government databases without enforcing strict authentication controls. The alleged exploitation of a password reset flaw compounds the issue, suggesting insufficient hardening of account recovery workflows. With over 200,000 driver records potentially exposed, this incident underscores how a single weak link in an interconnected system can lead to mass data exposure affecting civilians who have no choice but to share their information with government agencies.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ShinyHunters