The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that a single police employee’s login credentials opened the door to a breach of its DAVID driver database, according to a September 11, 2026 statement from the agency and reporting by Tampa Bay 28. The outlet identified the source of the compromised access as a Plant City Police Department employee whose DAVID login had been improperly stored on a personal electronic device, a detail that finally puts a name and a department behind a story that has been unfolding in pieces for more than a week.
The confirmation lands in the middle of a genuinely confusing news cycle. Two competing accounts of how Florida’s driver database got breached have been circulating since early September, and until Tampa Bay 28’s report, it was not clear whether they described the same incident or two separate ones. This piece untangles what FLHSMV has actually confirmed, what the extortion group ShinyHunters claims happened, where the two accounts diverge, and what the credential-management failure means for every government agency that still lets employees carry system logins on personal phones.
What FLHSMV Confirmed on September 11
FLHSMV’s official statement is narrow and carefully worded. The agency says it learned of a data breach on September 4, 2026, conducted by what it called an international cybercriminal organization, and that the intrusion was quickly mitigated with no further breach occurring or ongoing. Tampa Bay 28’s reporting adds the piece FLHSMV’s statement doesn’t spell out directly: the point of entry was one Plant City Police Department employee’s login credentials for DAVID, the Driver and Vehicle Information Database, which had been stored on a personal device rather than agency-issued hardware.
That framing matters. FLHSMV is not describing a platform-wide vulnerability. It is describing a single compromised account, tied to a single employee, at a single municipal police department. The Florida DMV data breach, in FLHSMV’s own account, is a credential-hygiene failure rather than a software flaw in DAVID itself.
The Other Story: ShinyHunters’ Password-Reset Claim
Running in parallel is a second, louder account from the extortion group ShinyHunters. The group told BleepingComputer that it broke into DAVID through a password-reset flaw that let attackers compromise multiple accounts, including ones belonging to DMV employees and an FBI agent. ShinyHunters claims it began pulling driver records around September 3, 2026, iterating through record IDs and downloading the associated HTML pages and images, and says it walked away with more than 200,000 records before losing access as the flaw was patched.
As proof, the group posted a screenshot purportedly showing Jeffrey Epstein’s DAVID record, including an address, Social Security number, birth date, driver’s license ID, and vehicle registration history. BleepingComputer reported that it contacted both FLHSMV and the FBI for comment and had not received a response by the time of publication.
Notice what does not match. ShinyHunters describes a password-reset vulnerability compromising several accounts across multiple agencies. FLHSMV describes one Plant City officer’s mishandled credentials. Neither account, as reported, explicitly confirms the other is describing the same event, and FLHSMV’s public statement does not mention ShinyHunters by name at all.
Timeline: How the Florida DMV Data Breach Story Unfolded
Laid end to end, the reporting from FLHSMV, BleepingComputer, and Tampa Bay 28 produces the following sequence of events for the Florida DMV data breach:
| Date | Event | Source |
|---|---|---|
| Sept. 3, 2026 | ShinyHunters says it began extracting DAVID driver records via an alleged password-reset flaw | BleepingComputer |
| Sept. 4, 2026 | FLHSMV learns of a breach it attributes to “an international cybercriminal organization”; says it was quickly mitigated | FLHSMV statement |
| Sept. 8, 2026 | ShinyHunters goes public, claims 200,000+ stolen records, posts a screenshot of a high-profile individual’s DAVID record | BleepingComputer |
| Sept. 11, 2026 | FLHSMV publishes its formal breach statement; confirms law enforcement is investigating | FLHSMV.gov |
| Sept. 11, 2026 | Tampa Bay 28 reports the breach traced to a Plant City PD employee’s DAVID login, stored on a personal device | Tampa Bay 28 |
| Sept. 12-13, 2026 | Follow-up coverage attempts to reconcile the ShinyHunters password-reset claim with FLHSMV’s single-credential account | BleepingComputer, Tampa Bay 28 |
The dates alone raise the central open question in this story: did a platform-level password-reset flaw exist alongside a separate, unrelated Plant City credential leak, or is Tampa Bay 28’s Plant City detail actually the root cause behind the wider ShinyHunters incident, described by FLHSMV in more conservative terms? Neither FLHSMV nor Tampa Bay 28 has published anything connecting the two explicitly.
Two Accounts, Side by Side
Because outlets have reported these as two threads of the same broader story, it helps to compare them directly rather than treat either as the full picture.
| Detail | ShinyHunters’ account | FLHSMV’s account |
|---|---|---|
| Entry point | Password-reset flaw compromising multiple accounts | One compromised employee credential |
| Accounts affected | Multiple DMV employees plus one FBI agent | One Plant City PD employee |
| Root cause | Platform vulnerability in DAVID’s authentication flow | Login improperly stored on a personal device |
| Records claimed | More than 200,000 | Not officially quantified by FLHSMV |
| Current status | Claims to have lost access; says the flaw is being patched | Says the breach was “quickly mitigated,” with no ongoing breach |
| Names the other party? | No mention of a Plant City-specific credential | Statement does not name ShinyHunters |
What DAVID Actually Holds
DAVID, short for the Driver and Vehicle Information Database, is not a public-facing DMV portal. It is a query system that gives law enforcement and authorized officials immediate retrieval of driver and motor vehicle records, and it also functions as Florida’s primary reporting mechanism for fatalities and serious bodily injury in crashes, according to BleepingComputer’s description of the system. Access is meant to be restricted to vetted personnel at agencies like local police departments, not general DMV customers, which is precisely why a single officer’s login carries outsized risk. Whoever holds valid DAVID credentials inherits query access across the same categories investigators use: license transactions, addresses, insurance records, prior vehicle history, and parking permits.
That access model is also why the Plant City detail is more alarming than a typical vendor breach. A compromised e-commerce password exposes one account. A compromised DAVID credential exposes a law-enforcement-grade lookup tool across driver records statewide, for as long as the session or credential remains valid.
The Personal-Device Problem Behind the Florida DMV Data Breach
The specific failure FLHSMV and Tampa Bay 28 describe, a government login stored on a personal phone or laptop rather than agency-managed hardware, is one of the oldest and least glamorous problems in credential security. It bypasses almost every network-layer defense an agency builds, because the attacker never has to breach a firewall or exploit a server. They only need access to the device, or the credential cached on it, through commodity malware, a phishing kit, or simple device theft.
Security teams auditing for this exposure typically start with something as basic as checking what credentials Windows itself has cached locally, since browsers and OS-level credential managers routinely retain logins the user assumes they only entered once:
:: Windows Credential Manager audit — list all cached credentials on a device
cmdkey /list
:: Flag any entry referencing an internal or government domain,
:: then rotate and remove credentials that should never persist on
:: unmanaged or personal hardware.That kind of basic audit is exactly the control gap FLHSMV’s statement implies was missing: nothing in the agency’s account suggests DAVID itself was compromised at the code level, only that one credential existed somewhere it should not have.
A Bad Month for Driver Data in Florida
This is not an isolated event on the calendar. According to a report cited by NBC News affiliates, FLHSMV’s September breach makes it the second organization holding Americans’ driver’s license information confirmed hacked in the same month, days after a separate identity-verification vendor disclosed a breach of driver’s license and ID data. Florida’s DMV, in other words, is not dealing with an isolated incident so much as sitting in the middle of a broader wave of driver-credential exposure hitting government and identity-verification infrastructure simultaneously.
That pattern is consistent with what this outlet has already tracked this month: a second confirmed hack at FLHSMV in the same week, the officer’s-device leak that first surfaced the personal-device angle, and a broader look at why DMV breaches keep repeating across state agencies nationally. What Tampa Bay 28’s reporting adds on top of that prior coverage is the specific department, Plant City, and FLHSMV’s own official acknowledgment that a single credential was the point of failure.
ShinyHunters’ Extortion Playbook, Applied to a State Agency
ShinyHunters has a well-documented pattern, according to BleepingComputer’s reporting: the group has been active since 2018, starting with attacks on Salesforce environments and later linked to breaches at Google, Cisco, PornHub, and Match Group. More recently it pivoted to voice-phishing, or vishing, campaigns targeting Okta, Microsoft, and Google single sign-on accounts, including device-code vishing attacks aimed at stealing Microsoft authentication tokens. It was also behind the Instructure Canvas breach in May, which caused a major outage before the company reportedly reached an agreement with the group to prevent a full data leak.
This outlet previously covered the group’s 72-hour extortion deadline against Florida’s DMV and its decision to post a high-profile record as proof of the intrusion. BleepingComputer also notes that individuals tied to the ShinyHunters name have already faced arrests connected to the Snowflake data-theft campaign, PowerSchool breaches, and the operation of the Breached v2 hacking forum in France, which suggests the group operates more as a loosely affiliated brand than a single, stable organization.
Why This Keeps Happening to Government Driver Databases
State driver databases sit in an awkward middle ground. They are not consumer-facing enough to get the security investment of a bank or retailer, but they are accessed by thousands of officers, clerks, and municipal employees across hundreds of separate agencies, each with its own device policies, training standards, and enforcement. FLHSMV can harden its own servers indefinitely and still be exposed the moment one of those thousands of external users stores a credential somewhere insecure.
That structural weakness is why identity governance specialists increasingly argue that credential lifecycle management, not perimeter security, is the real gap in systems like DAVID. A single compromised login, as this incident illustrates, can matter as much as a full platform vulnerability, because the access it grants is functionally identical either way.
Market Impact: Government Identity Security Gets a Fresh Case Study
Every publicized government credential failure tends to accelerate procurement conversations that were already underway. Vendors selling privileged access management, phishing-resistant multifactor authentication, and credential-detection tooling to state and local agencies now have a concrete, named example, a municipal police department’s DAVID login stored on a personal device, to use in sales conversations about why device-bound credential policies and hardware-backed authentication matter more than password complexity rules.
State and local governments have historically lagged federal agencies on adopting phishing-resistant authentication, in part because rolling out hardware security keys or managed device enforcement across hundreds of independent municipal departments is logistically harder than doing it inside a single federal agency. Incidents like this one, tied to a specific, named department rather than an abstract “state government,” tend to be the kind of evidence that pushes budget approvals for identity modernization projects that had been stuck for years. Readers evaluating those controls can review the mechanics in this outlet’s guide to setting up phishing-resistant MFA.
Legal Exposure: What DPPA Means Here
Driver records fall under the federal Driver’s Privacy Protection Act, which restricts how personal information collected by state motor vehicle agencies can be disclosed and creates liability exposure when that information is accessed without a permissible purpose. Neither FLHSMV’s statement nor the outlets covering it have described a filed lawsuit or a named regulatory enforcement action tied specifically to the Plant City credential incident as of this writing; FLHSMV’s own language stops at confirming that law enforcement is investigating and that the breach remains a criminal matter.
That said, DPPA claims have historically followed unauthorized DMV data access incidents once the scope of exposure becomes clearer, and the presence of a named department and a specific, described credential failure gives plaintiffs’ attorneys a more concrete factual basis to work from than a vague “international cybercriminal organization” attribution alone.
How This Compares to Other 2026 Credential Failures
Credential mismanagement, rather than novel exploit code, has been the recurring theme across this year’s largest breach disclosures. Verizon’s 2026 Data Breach Investigations Report found that exploited vulnerabilities overtook stolen credentials as the single most common breach vector industry-wide at roughly 31%, according to the Verizon DBIR, but credential abuse remains a dominant factor specifically in breaches involving third-party and government access, which is exactly the category this Florida DMV data breach falls into.
The FBI’s Internet Crime Complaint Center continues to track business email compromise and credential-based intrusions as among the costliest categories of reported cybercrime, and the bureau’s IC3 portal remains the standard channel for individuals whose driver or identity records may have been exposed to file a formal complaint.
What Happens Next: Five Predictions
- FLHSMV will eventually quantify the exposure. Agencies that describe a breach as “mitigated” without a record count typically follow up within weeks once forensic review completes, especially given active media and legal attention.
- Plant City PD will face a policy review, not just a technical one. Expect an internal audit of how many other municipal officers store DAVID or similar law-enforcement database credentials on personal devices, since FLHSMV’s statement implies this was a known-possible but unenforced policy violation.
- ShinyHunters’ 200,000-record claim will remain unverified by FLHSMV for some time. State agencies have historically been slow to confirm attacker-supplied figures, preferring internal forensic counts even when they lag public reporting by weeks.
- More states will disclose DAVID- or NLETS-adjacent credential exposures. Once one law-enforcement data-sharing credential failure becomes public, security researchers and journalists tend to find comparable gaps in other states’ systems within the same news cycle.
- Expect renewed legislative pressure on device policies for law-enforcement database access. Florida lawmakers have introduced credential-hygiene mandates after past breaches, and a named department with a named failure mode is the kind of case that tends to move stalled bills forward.
The Bigger Picture for Consumers
For Florida drivers, the practical takeaway is limited but real. FLHSMV has not published a consumer notification process specific to this incident as of September 13, 2026, and has not confirmed whose records were viewed. Anyone concerned about exposure through Florida’s driver systems can review general guidance from the Federal Trade Commission’s data breach response resources while waiting for FLHSMV to issue specific notifications, which state law typically requires once the scope of a confirmed breach is established.
Frequently Asked Questions
What caused the Florida DMV data breach?
FLHSMV says a data breach it discovered on September 4, 2026 was carried out by what it calls an international cybercriminal organization. Tampa Bay 28 reported that the point of access was a Plant City Police Department employee’s DAVID database login, which had been improperly stored on a personal electronic device.
Is this the same breach ShinyHunters claimed responsibility for?
It’s unclear. ShinyHunters told BleepingComputer it exploited a password-reset flaw affecting multiple accounts starting around September 3, 2026. FLHSMV’s official statement describes a single compromised credential and does not name ShinyHunters, so as of this writing the two accounts have not been officially confirmed to describe the same incident.
How many records were exposed in the Florida DMV data breach?
FLHSMV has not published an official record count. ShinyHunters claims to have stolen more than 200,000 records, but that figure comes from the attacker’s own extortion claims, not from FLHSMV’s confirmed disclosure.
What is the DAVID database?
DAVID stands for the Driver and Vehicle Information Database. It gives Florida law enforcement and authorized officials immediate access to driver and motor vehicle records and serves as the state’s primary reporting mechanism for crash fatalities and serious bodily injuries.
Was Plant City Police Department itself hacked?
Reporting describes the compromise as tied to one employee’s credentials rather than a breach of Plant City PD’s own internal systems. The credentials had reportedly been stored on the employee’s personal device rather than agency-managed hardware.
Has anyone been arrested or charged?
Tampa Bay 28 reports the incident remains under criminal investigation. No arrests or charges tied specifically to this credential compromise have been publicly confirmed as of September 13, 2026.
What should Florida drivers do right now?
FLHSMV has not issued a specific consumer notification process for this incident as of publication. Drivers concerned about exposure can monitor for official FLHSMV communications and consult general data breach response guidance from the FTC in the meantime.
How does this compare to other recent driver-data breaches?
This is reported to be the second organization holding Americans’ driver’s license data confirmed hacked in September 2026 alone, following a separate breach at an identity-verification vendor earlier in the month, underscoring a broader pattern of credential-driven exposure across driver and identity data systems this year.
