Stolen Plant City Police Credentials Led to Florida Driver Database Breach
Florida confirmed that its DAVID driver database was breached using stolen credentials from a Plant City Police Department employee. The Florida Department of Highway Safety and Motor Vehicles learned of the breach on September 4 and says it was quickly mitigated. The ShinyHunters extortion group claimed it accessed more than 200,000 driver records, though Florida has not confirmed that number or disclosed how many records were taken. The credentials had been improperly stored on the employee's personal electronic device.
How the Attack Occurred
The Florida Department of Highway Safety and Motor Vehicles determined that an attacker used stolen credentials from a single Plant City Police Department user account. The credentials had been improperly stored on the employee's personal electronic device, allowing the attacker to gain access to the DAVID system.
The agency learned of the breach on September 4 and says it was quickly mitigated. Florida has notified the Office of the Attorney General and is working with the Florida Digital Service and Florida Department of Law Enforcement. The agency says this is an ongoing criminal investigation and further information will be released later.
Attacker Claims Differ From State Findings
ShinyHunters claimed it exploited a password reset flaw to access multiple DAVID accounts, including those belonging to DMV employees and an FBI agent. The group said it began downloading records on September 3 by iterating through DAVID record IDs and saving HTML pages and images.
ShinyHunters provided a screenshot of a DAVID record as proof and claimed it had stolen more than 200,000 records. The group later told BleepingComputer that it lost access and believed the flaw was being patched. Florida's investigation concluded the access method was stolen police credentials, not a password reset vulnerability.
Scope of Exposed Data Unclear
Florida has not disclosed how many driver records were accessed or stolen. The state also has not confirmed ShinyHunters' claim of more than 200,000 records. The screenshot shared by ShinyHunters showed a DAVID record containing sensitive personal and vehicle information.
The extent of the breach and whether stolen records have been published or sold is not known. The state has not announced what types of information were accessible through the compromised credentials.
Why Credentials Were at Risk
The breach succeeded because a police department employee stored DAVID credentials on a personal device in a way that allowed them to be compromised. The source does not specify how the credentials were stored or how the attacker obtained them from the personal device.
This case illustrates the risk created when system credentials are not stored securely, a general security principle that applies regardless of whether the system is accessed by internal staff or external authorized users.
State Response and Investigation
Florida says the breach was quickly mitigated and no further unauthorized access has occurred or is ongoing. The state is working with the Florida Digital Service and Florida Department of Law Enforcement and has notified the Office of the Attorney General.
Because the investigation is ongoing, the state says further information will be released at an appropriate time. Florida has not stated what mitigation actions were taken or whether system access procedures have changed.
Steps for Florida Drivers
Florida has not announced whether it will send individual breach notifications to affected drivers. Because the number of affected records is not confirmed, drivers cannot yet know whether their information was accessed.
As a general precaution following any large-scale data breach, you should monitor your credit reports and watch for unauthorized accounts or suspicious activity. You can freeze your credit files with the three major bureaus and set up alerts for new account openings. If you receive unsolicited calls or messages claiming to be from the DMV or law enforcement and asking for personal information, verify the contact through official channels before responding.
- Monitor your credit reports for unauthorized accounts or suspicious activity
- Consider freezing your credit files with the three major bureaus
- Set up alerts for new account openings
- Verify the authenticity of any DMV or law enforcement contacts through official channels before providing information
Questions readers ask
How did attackers access the Florida driver database?
According to Florida's investigation, attackers used compromised credentials from a Plant City Police Department employee. The credentials had been improperly stored on the employee's personal electronic device. ShinyHunters claimed it exploited a password reset flaw, but Florida concluded stolen credentials were the access method.
How many Florida driver records were stolen?
Florida has not disclosed the number of records accessed or stolen. ShinyHunters claimed to have taken more than 200,000 records, but the state has not confirmed that figure. The breach was discovered on September 4 and Florida says it was quickly mitigated.
Will Florida notify drivers whose records were breached?
Florida has not announced whether it will send individual breach notifications to affected drivers. The state says the investigation is ongoing and further information will be released later.
What is the DAVID system?
DAVID is the driver database that Florida law enforcement agencies use. The source does not describe what information DAVID contains or how it functions.
Has the stolen data been published?
The source does not state whether the stolen records have been published or offered for sale. ShinyHunters is an extortion group, but whether the group has released the data or is attempting extortion is not confirmed in the report.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.