ShinyHunters claims breach of Florida DMV database, threatens release of driver records

The extortion group ShinyHunters claims it breached an online platform used by the Florida Department of Highway Safety and Motor Vehicles, known as DAVID, and stole records belonging to more than 200,000 drivers in the state. The group added the Florida agency to its dark web leak site, with a listing updated September 7 and labeled a "final warning," giving officials until September 11, 2026, to make contact or face release of the stolen files.

FLHSMV has not publicly confirmed a cyberattack or data breach tied to the claim.

As evidence of the intrusion, the group released a screenshot showing a record for Jeffrey Epstein pulled from the DAVID system. The image includes his photograph, signature, Social Security number, driver identification number, a former residential address, physical descriptors, and information tied to registered vehicles. The interface shown in the sample includes sections for driver history, documents, photographs, signatures, addresses, insurance, prior vehicles and parking permits, and its layout is consistent with Florida’s DAVID system. The screenshot alone does not establish how or when the data was obtained.

DAVID stands for Driver And Vehicle Information Database and is described by FLHSMV as a system that gives law enforcement and criminal justice officials immediate access to driver and motor vehicle information. The agency also identifies it as the primary reporting mechanism for fatalities and serious bodily injuries.

ShinyHunters told BleepingComputer that the intrusion exploited a password-reset flaw allowing them to compromise multiple accounts within the system, which they said belonged to DMV employees and an FBI agent. Using that access, the group said it iterated through records by ID number and downloaded associated HTML files and images, obtaining more than 200,000 records since the breach began on September 3. The group told BleepingComputer it has since lost access to the database and that the password-reset flaw is being patched.

A source told BleepingComputer that the threat actors are also targeting motor vehicle platforms in other states using social engineering attacks. ShinyHunters told BleepingComputer it expects to announce additional breaches in the coming weeks.

ShinyHunters has a history of breach claims that were later confirmed by affected organizations or supported by published data, though the Florida claim remains unverified pending a response from FLHSMV or the release of further evidence. If confirmed, the incident could represent a significant breach involving sensitive personal, driving and vehicle information belonging to Florida residents.

ShinyHunters is an extortion group linked to data theft attacks against online web applications and cloud software-as-a-service environments, with the name tied to threat actors conducting breaches since 2018. Over the past year, the group has become one of the most prolific data theft and extortion operations targeting companies worldwide, with breaches linked to Google, Cisco, PornHub and Match Group. The group commonly compromises third-party integration providers and uses stolen authentication tokens to access connected SaaS platforms and steal customer data.