The ShinyHunters extortion gang claims it breached Florida’s “DAVID” — the Driver and Vehicle Information Database operated by the Florida Highway Safety and Motor Vehicles (FLHSMV) agency — and stole records for more than 200,000 Florida drivers. DAVID is used by law enforcement and government officials to look up driver information; it stores names, addresses, Social Security numbers, birth dates, driver’s license numbers and issue/expiration dates, registered vehicles, and additional tabs covering license transactions, insurance, and parking permits. As proof, ShinyHunters published a screenshot of a named individual’s full DAVID record, including their SSN and vehicle history.
According to the group, the breach began on September 3rd and was made possible by a password-reset flaw that allowed them to compromise multiple DAVID accounts — including those belonging to DMV employees and at least one FBI agent. Using those accounts, the attackers iterated through the system’s records by sequential IDs and downloaded the associated HTML and images. The hackers say they have since lost access and that the password-reset vulnerability is being patched. ShinyHunters added FLHSMV to their data leak site and are demanding negotiations; if no agreement is reached, they say they will publish the full dataset. BleepingComputer contacted FLHSMV and the FBI; neither had responded at the time of reporting.