Loading story…
The Florida Department of Highway Safety and Motor Vehicles confirmed that an attacker accessed its DAVID driver-information database using credentials assigned to a Plant City Police Department user. The agency said the credentials had been improperly stored on the employee’s personal device, learned of the incident on September 4, and has contained the breach; it says there is no ongoing intrusion. FLHSMV is investigating with the Florida Digital Service and other state authorities and has notified relevant Florida government offices.
The ShinyHunters extortion group claimed responsibility, alleging it exploited a password-reset weakness, accessed multiple accounts, and stole more than 200,000 driver records. It published purported screenshots of a DMV record linked to Jeffrey Epstein as evidence, but FLHSMV has not validated the alleged flaw, the claimed scope of access, or the record count. Officials initially considered a possible connection to the separate IDScan breach, though no link has been established.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
FLHSMV said it learned of a breach affecting its DAVID driver database. It determined that an international cybercriminal organization used compromised credentials for a single Plant City Police Department user that had been improperly stored on the employee's personal device.
ShinyHunters claimed it began iterating through DAVID record identifiers and downloading associated HTML pages and images. The group alleged that it ultimately obtained more than 200,000 driver records, a count FLHSMV has not validated.
FLHSMV said it quickly mitigated the intrusion and that no ongoing breach remained. The agency notified the Florida Office of the Attorney General and began coordinating its response with the Florida Digital Service and Florida Department of Law Enforcement.
ShinyHunters later said it had lost access to the DAVID system and believed the alleged password-reset flaw was being patched.
ShinyHunters claimed responsibility for accessing FLHSMV data and shared purported images of a DAVID record associated with Jeffrey Epstein as proof. The group asserted it used a password-reset flaw to access multiple DAVID accounts, an access method FLHSMV did not confirm.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Identity-verification provider **IDScan** confirmed that attackers stole data from its cloud systems during a reportedly year-long intrusion. The compromised dataset includes full names, driver’s-license numbers, and identification numbers from other government documents, including passports; IDScan holds more than 150 million driver’s-license records. The records were advertised on a dark-web marketplace and reportedly searchable for more than 150 million people in the United States and Canada, potentially including photographs. The seller and breach method have not been publicly identified, while IDScan continues its investigation and the FBI is investigating; the Pentagon said it was aware of reports that Defense Secretary Pete Hegseth’s information appeared in the database.
Sep 11, 2026
AssuranceAmerica disclosed a data breach affecting **6.99 million people**, exposing names, contact details, **driver’s license numbers**, and other insurance-related information tied to auto insurance policies, accounts, drivers, vehicles, and customer claims. The company said it discovered attackers in its systems on March 17 and completed its investigation on June 15, concluding that customer data had been stolen in what appears to be the largest known reported exposure of Americans’ driver’s license information this year. The insurer said the intrusion involved a targeted employee account and that the compromised credentials were later disabled, but it did not disclose the exact intrusion method or whether extortion or ransom demands were involved. Filings with the Indiana and Maine attorney general offices corroborated the scale of the breach, and customer notification letters are expected to begin on July 10.
Jul 10, 2026
Texas Parks & Wildlife disclosed a data breach affecting more than **3 million people** after the state’s cybersecurity unit detected unauthorized access involving the department’s license system vendor. The exposed data was tied to hunting and fishing license transactions and included **driver’s license numbers, passport numbers, email addresses, phone numbers, and residential addresses**, according to reporting and statements attributed to the Texas attorney general. The agency said the intrusion involved a vendor system used to process license information, but it did not identify the vendor or disclose the exact timing or method of the compromise. Officials also did not say whether the attackers had contacted the department, leaving key questions unanswered as the incident stands as one of the largest reported data breaches affecting Texas this year.
Jun 29, 2026