Investigation “ongoing”
Florida DMV hacked after police dept insecurely stored login info
Florida issues alerts after statewide DMV data breach linked to ShinyHunters.
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying victims impacted by a recent data breach of driver’s license and motor vehicle data, but not everyone whose information was stolen will receive an alert.
In a notice posted Friday, FLHSMV confirmed that it took “immediate steps” after discovering that “a malicious actor accessed certain department records on September 4, 2026, using compromised credentials.” There’s “no evidence” that data has yet been misused, the department said, but law enforcement “determined the information potentially affected includes driver license and motor vehicle data, to include document images, and other personal information.”
FLHSMV is sending out letters to everyone affected, offering victims one year of credit monitoring from Sontiq, Inc. However, the state acknowledged that it may not have current contact information for many former Florida residents whose data was still being stored. Those potential victims can confirm if their data was stolen by emailing FLHSMV at customerinquiry@flhsmv.gov, officials said.
For all current and former Florida residents, FLHSMV recommended taking precautions, including monitoring financial accounts and reviewing credit reports for any suspicious activity. In a thread on the Florida subreddit, several Floridians confirmed that they had already taken officials’ third recommendation and placed “a fraud alert or security freeze with major credit bureaus.”
Some residents complained that they received notice only this week, even though the breach occurred more than a month ago. The breach was previously reported by news outlets.
ShinyHunters linked to hack
On a webpage describing the security incident, FLHSMV confirmed that an “international cybercriminal organization” was behind the breach but did not specify which group or how long they had access. Instead, officials claimed to have “promptly mitigated the breach, launched an investigation, and issued required notification to state authorities.”
Mitigations included “blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information,” FLHSMV said.
Florida’s investigation is “ongoing,” officials said, but a cybercriminal group called ShinyHunters—which recently claimed credit for hacking the FBI—may have stolen the data. Last month, NBC Miami reviewed a dark web post in which ShinyHunters announced that it had hacked Florida’s DMV and given officials a September 11 deadline to negotiate a fee to stop leaks of the data.
To prove the breach was real, ShinyHunters posted a photo of the “alleged driver’s license for late financier and convicted sex offender Jeffrey Epstein, a former Florida resident,” NBC Miami reported.
But soon after that post was published, ShinyHunters made edits, removing all mentions of Florida, NBC Miami noted. Ian Gray, vice president of intelligence at the threat monitoring company Flashpoint, told NBC Miami this was a likely indication that Florida officials were negotiating with ShinyHunters to prevent a leak of the database.
Police department leaked login
FLHSMV did not mention ShinyHunters in its announcement and did not answer NBC Miami’s questions about the dark web post. In their announcement, officials said they would post an update when more information is available to share publicly.
The hack appears to be unrelated to a major breach of 153 million US driver’s licenses involving a company called IDscan.net last month, NBC Miami reported. But both hacks highlight how easy it is to get access to millions of Americans’ personal information, which will only get easier as AI advances and simplifies the process of scanning for vulnerabilities, NBC suggested.
In Florida’s case, “a criminal actor gained unauthorized access to a department system” by acquiring the “credentials from an employee of a local Florida law enforcement agency, who improperly stored the credentials on an electronic device,” FLHSMV’s FAQ said.
