The Florida Department of Highway Safety and Motor Vehicles has confirmed that a malicious actor accessed department records on September 4, 2026, using compromised credentials, in a breach affecting current and former Florida residents. In a notice posted Friday, FLHSMV said law enforcement determined the potentially affected information includes driver license and motor vehicle data, including document images, and other personal information. The department said there is no evidence the data has yet been misused.
The agency said it took immediate steps after discovering the intrusion. According to an FAQ cited by the department, a criminal actor gained unauthorized access to a department system after obtaining credentials from an employee of a local Florida law enforcement agency who had improperly stored the credentials on an electronic device. FLHSMV said it blocked unauthorized access, reset relevant user credentials, engaged cybersecurity professionals, and implemented additional safeguards to protect sensitive information, and that it promptly mitigated the breach, launched an investigation, and issued required notification to state authorities. The state’s investigation is ongoing.
FLHSMV is sending letters to everyone affected offering one year of credit monitoring from Sontiq, Inc. The state acknowledged it may not have current contact information for many former Florida residents whose data was still being stored. Those potential victims can confirm whether their data was stolen by emailing customerinquiry@flhsmv.gov.
The department recommended that all current and former Florida residents monitor financial accounts and review credit reports for suspicious activity. In a thread on the Florida subreddit, several Floridians said they had already placed a fraud alert or security freeze with major credit bureaus. Some residents complained they received notice only this week, more than a month after the breach occurred; the breach had previously been reported by news outlets.
On a webpage describing the security incident, FLHSMV confirmed an international cybercriminal organization was behind the breach but did not specify which group or how long it had access. A cybercriminal group called ShinyHunters, which recently claimed credit for hacking the FBI, may have stolen the data. Last month, NBC Miami reviewed a dark web post in which ShinyHunters announced it had hacked Florida’s DMV and given officials a September 11 deadline to negotiate a fee to stop leaks of the data. To prove the breach was real, ShinyHunters posted a photo of the alleged driver’s license for late financier and convicted sex offender Jeffrey Epstein, a former Florida resident, NBC Miami reported.
Soon after that post was published, ShinyHunters made edits removing all mentions of Florida, NBC Miami noted. Ian Gray, vice president of intelligence at the threat monitoring company Flashpoint, told NBC Miami this was a likely indication that Florida officials were negotiating with ShinyHunters to prevent a leak of the database. FLHSMV did not mention ShinyHunters in its announcement and did not answer NBC Miami’s questions about the dark web post. NBC Miami reported that the hack appears unrelated to a major breach of 153 million US driver’s licenses involving a company called IDscan.net last month.
More cybersecurity news from TechManNews.
