ShinyHunters Claims Breach of Florida "DAVID" DMV Database
The ShinyHunters extortion gang added the Florida Highway Safety and Motor Vehicles (FLHSMV) "DAVID" driver and vehicle information database to its leak site, claiming to have stolen over 200,000 driver records since 3 September through a password-reset flaw that let it compromise accounts allegedly belonging to DMV employees and an FBI agent, then iterate records by ID.
| Attribute | Detail |
|---|---|
| Victim | Florida FLHSMV "DAVID" driver/vehicle database |
| Claimed scope | 200,000+ driver records |
| Vector | Password-reset flaw; social engineering |
| Proof | Screenshot of Jeffrey Epstein's real DAVID record (address, SSN, vehicles) |
| Status | Access reportedly lost (flaw being patched); other states' DMV reportedly targeted |
| Verification | Probable breach — victim/FBI not confirmed at publication |
| Source | BleepingComputer — Tier 2/4 |
ShinyHunters told BleepingComputer it has since lost access and expects to announce other states' DMV breaches, with a source confirming the gang is attacking other states' DMV platforms via social engineering. FLHSMV and the FBI had not responded at publication. This marks an escalation from SaaS/Metabase data-theft into government driver-record infrastructure.
Related Pages
- Shinyhunters — the group behind the campaign
- Shinyhunters Leaks 7 1 Million Records Claimed From Medical Device Maker Baxter — earlier ShinyHunters activity
Source
Update — 2026-09-12: FLHSMV confirms the breach
The Florida Department of Highway Safety and Motor Vehicles confirmed the DAVID breach on 11 September, three days after ShinyHunters' claim. FLHSMV says it learned of the incident on 4 September and mitigated it quickly, and traced the access to compromised credentials belonging to a single Plant City Police Department user that had been improperly stored on that employee's personal electronic device.
The agency's account of the access method differs from the gang's: ShinyHunters claimed a password-reset flaw reaching multiple DAVID accounts, including DMV employees and an FBI agent. FLHSMV has not confirmed ShinyHunters' figure of more than 200,000 records, nor disclosed how many records were accessed. It has notified the Florida Attorney General and is working with the Florida Digital Service and the Florida Department of Law Enforcement.
Classification: Confirmed breach (victim-disclosed). Access vector: stolen credentials improperly stored on a personal device — not the password-reset flaw originally claimed.
Source: BleepingComputer, {DATE}.