← News
/DISPATCH · 2026-09-11

ShinyHunters Claims Theft of 200,000 Florida DMV License Records, Sept 11 Negotiation Deadline

ShinyHunters listed Florida Highway Safety and Motor Vehicles on its dark-web leak site, claiming a password-reset flaw in the law-enforcement DAVID database yielded 200,000+ license and vehicle records, with a Sept 11 negotiation deadline. Officials have not confirmed.

Incident Overview

On 7 September 2026, data-extortion group ShinyHunters listed the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) on its dark-web leak site, claiming theft of more than 200,000 driver's license and vehicle records from DAVID (Driver And Vehicle Information Database), a law-enforcement-only database, and set an 11 September publish deadline. As of publication, FLHSMV has not publicly confirmed a breach.

Technical Details

Per ShinyHunters' account to media, the intrusion began 3 September 2026 via a password-reset logic flaw in DAVID, used to take over multiple internal accounts, some claimed to belong to DMV staff and an FBI agent. With access, attackers iterated queries by record ID, packed the corresponding HTML pages and driver photos, and obtained more than 200,000 records. The group also claimed access had been cut and the password-reset flaw was being patched.

To prove authenticity, ShinyHunters published a screenshot of deceased financier Jeffrey Epstein's DMV record: photo, signature, Social Security number, license number, address, and registered vehicles. UI layout matches Florida DAVID. A screenshot does not prove when or how the data was obtained; leak-site claims are advertising, not confirmed breach facts.

Impact Assessment

DAVID is not a public database. It is a restricted system for law-enforcement and criminal-justice personnel to query driver and vehicle data in real time, and the primary reporting channel for fatal and serious-injury crashes. Leak risk differs from typical e-commerce user data: the industry calls a driver's license identity's "master key"—photo, signature, address, date of birth, permanent identifiers that cannot be reset like a password. Attackers can open fraudulent accounts, run highly convincing phishing and password-reset attacks, or impersonate victims for insurance, medical, tax, and government-benefit fraud. Correlation with previously leaked SSNs further amplifies harm.

Note a concurrent, independent license-data black-market lead: researchers disclosed dark-web service Nexus selling 153 million US/Canada driver's license scans (sourced from identity-verification vendor IDScan.net); the FBI has opened an investigation. Sources differ—the former is a restricted government database, the latter commercial ID-verification scans—but both point to systemic risk across the identity-credential collection–storage–circulation chain.

Remediation

References