Motor Vehicle Data Accessed After Officer Stored Login on Personal Device

How Credentials Were Compromised

Florida officials said the breach occurred after an attacker obtained credentials belonging to a Plant City Police Department user. That officer had improperly stored login information on a personal electronic device. The attacker then used those credentials to access FLHSMV systems.

The department described the attacker as part of an international cybercriminal organization but did not name the group in its initial statement. Plant City is a small suburb outside Tampa. Officials did not disclose what type of personal device was involved or how the attacker obtained the credentials from it.

ShinyHunters Claims Responsibility

On Monday, the ShinyHunters cybercriminal organization claimed it had obtained access to FLHSMV data. As proof, the group shared alleged photos of a DMV record tied to Jeffrey Epstein, the deceased financier and convicted sex offender. The department confirmed the breach publicly on Thursday evening after several days of silence.

Some cybersecurity experts initially speculated the incident might be connected to a separate breach at identity verification firm IDScan, which confirmed a leak of 153 million driver's licenses. ShinyHunters had previously asked to purchase the IDScan database, but Florida officials have not linked the two incidents.

Recent ShinyHunters Activity

The group has recently taken credit for attacks on bank IT provider Jack Henry and pharmaceutical and healthcare technology company McKesson. McKesson told regulators that data from oncology and surgical business units was stolen. In May, the group attacked a widely used educational software suite, causing disruption across the United States.

Other alleged victims include Carnival Cruises, Ticketmaster, AT&T, McGraw Hill, ADT and gaming company Rockstar. In April, the group stole information from more than four million people after attacking the world's largest medical device company.

Use of AI in Attacks

Anthropic released a report Thursday stating that suspected ShinyHunters affiliates used AI to scan for credentials and map unfamiliar systems. In one documented case, an operator escalated from a stolen developer token to full administrative access within approximately three hours.

Incident responders at Google confirmed last week that members of the group use AI tools from Anthropic at various stages of attacks. The reports show how AI can accelerate reconnaissance and privilege escalation once an attacker has initial access.

Scope of Exposure Unclear

The department has not disclosed what specific data was accessed, how many records were exposed or whether the stolen information has been sold or published. Florida has notified other government offices and is working with the Florida Digital Service to investigate.

The department has not announced whether affected individuals will be notified directly or what protective measures will be offered. The statement described only the initial access method and the involvement of a single user's credentials.

Steps to Protect Credentials

Government and law enforcement employees with database access should follow these practices to protect credentials:

1. Never store usernames or passwords on personal devices.
2. Use only organization-approved password managers or secure credential vaults.
3. Avoid saving login information in plain text files or unencrypted notes apps.
4. Report lost, stolen or compromised devices immediately to your IT security team.
5. Use multi-factor authentication for all systems containing sensitive data.
6. Review active credentials regularly and revoke access that is no longer needed.

Questions readers ask

Source and reporting limits

Based on reporting by The Record. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.