FLHSMV's own account of the incident, reported by BleepingComputer, traces the point of entry to a single account: a Plant City Police Department employee whose DAVID login credentials had been "improperly stored on the employee's personal electronic device." The agency's statement is careful and specific about the timeline: "On September 4, 2026, FLHSMV learned of a data breach conducted by an international cybercriminal organization. The data breach was quickly mitigated and no further breach has occurred or is ongoing." Notice what that statement does and doesn't say - it confirms an intrusion and a fix, but not a scope. The gap between "mitigated" and "how much was taken" is exactly where this story gets uncomfortable.
Two different accounts of how far it went
ShinyHunters' own version, given to BleepingComputer in a separate report, doesn't fully match FLHSMV's. The group says it used "a password-reset flaw that let them compromise multiple accounts in the system," not just the one stolen credential, and that the compromised accounts belonged to "DMV employees and an FBI agent." Once in, they claim to have iterated through driver IDs directly, pulling the HTML record and photo tied to each one - a brute-force harvesting method rather than a single bulk export. Whichever description is more accurate, both describe the same underlying weakness: a system built to serve individual lookups to trusted requesters had no effective limit on how many lookups a single compromised session could make.
A screenshot of Jeffrey Epstein's driver record, used as proof of access
The detail that turned this from a routine breach notice into a widely shared story was the group's choice of evidence. To prove they'd actually reached the database, ShinyHunters posted a screenshot containing Jeffrey Epstein's own DAVID record - address, Social Security number, birth date, driver's licence ID, issuance and expiration dates, and registered vehicles, alongside tabs for insurance history, prior vehicles and parking permits. It's a reminder of what "driver database" actually means as a target: not just license plates and addresses, but a durable, cross-referenced identity record on every driver in the state, including ones whose privacy the state has particular reason to protect.
Extortion with a clock attached
ShinyHunters listed Florida on its leak site on the night of 8 September, with the claimed haul running past 200,000 records - a figure FLHSMV has not confirmed either way. The group has since said it lost access to the database and that the password-reset flaw is being patched, while warning that further state DMV breaches would be announced "in coming weeks." FLHSMV, for its part, has notified the state Attorney General's office and is working the investigation jointly with the Florida Digital Service and the Florida Department of Law Enforcement - the standard posture for an incident the agency is treating as an active criminal matter rather than a closed one.
- Treat any credential stored on a personal device as compromised the moment its owning system shows unusual activity - policy violations don't stay theoretical once an account is actually misused.
- Rate-limit and monitor per-account lookup volume on any system that serves individual records to trusted users, including law enforcement and government portals - a single account making thousands of sequential lookups is a detectable pattern, not a subtle one.
- Password-reset flows are a recurring root cause across this year's breaches; audit yours specifically for whether a reset can be triggered or completed without re-verifying the requester's original identity.
- Where your organisation shares access to a state or partner-run database, confirm what audit trail you receive when their infrastructure - not yours - is the one that gets breached.
- Don't wait for the vendor or agency's own scope estimate to match the extortion group's claim before acting - respond to the wider of the two numbers until one side produces evidence.
A stolen password sitting on the wrong phone is a policy failure any organisation can have; what happens next depends on how quickly unusual access gets noticed and how tightly bulk lookups are controlled. If you'd like a second opinion on how exposed your own identity and records systems are to exactly this pattern, email sales@halfteck.com.