2026 Florida DHSMV (DAVID) — agency confirms breach via stolen Plant City PD account; ShinyHunters claimed ~200k
Data compromised
Driver/vehicle records in DAVID. FLHSMV has not published an individual census. ShinyHunters claimed >200,000 records and published a sample (including a Jeffrey Epstein-linked record) — census still unverified by the agency.
Technical writeup
Company/agency-confirmed — FLHSMV statement September 11, 2026 (learned of breach Sep 4). Investigation found attackers used compromised credentials for one Plant City Police Department DAVID user stored on a personal device; breach mitigated; AG/FDLE/Florida Digital Service engaged. Differs from ShinyHunters’ earlier claim of a password-reset flaw across multiple accounts. Agency has not confirmed the >200,000 record census. Catalog keeps recordsAffected 200000 as actor estimate (unverified count) with companyConfirmed true for the DAVID breach itself. Distinct from IDScan/Nexus DL-scan sale.
Root cause
Compromised credentials of a single Plant City Police Department DAVID user improperly stored on a personal device (FLHSMV); ShinyHunters had claimed password-reset / multi-account access
References
- https://www.csoonline.com/article/4220193/shinyhunters-claims-florida-dmv-breach-puts-data-on-the-clock.html
- https://www.ransomware.live/id/U3RhdGUgb2YgRmxvcmlkYSBETVZAc2hpbnlodW50ZXJz
- https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/
- https://x.com/flhsmv/status/2098239548660514979
- https://www.bleepingcomputer.com/news/security/shinyhunters-hackers-claim-breach-of-florida-david-dmv-database/