Most of us hand over a lot of personal information to the DMV because we have no choice.
asserted
we → hand → choice
Your address, birth date, driver's license information and other identifying details can all end up in government systems.
asserted
address → end → systems
That is why a breach involving driver records deserves attention.
asserted
breach → involve → attention
Florida officials have now confirmed that the Florida Department of Highway Safety and Motor Vehicles, or FLHSMV, experienced a data breach.
asserted
Department → confirm → breach
The agency says it learned about the incident on Sept. 4, quickly mitigated it and has seen no further breach or ongoing unauthorized access.
asserted
it → say → breach
The confirmation follows claims from the ShinyHunters extortion group that it accessed Florida's Driver and Vehicle Information Database, known as DAVID, and stole more than 200,000 driver records.
uncertain
it → follow → records
Florida has not confirmed that record count or publicly said exactly what information was taken.
asserted
information → confirm → count
Here's what ShinyHunters claims happened, what Florida says its investigation found and what drivers should do now.
uncertain
drivers → claim → what
Join our upcoming CyberGuy LIVE class: Get Better Health Care With AI
In this free live online class, Kurt "CyberGuy" Knutsson will show you five practical ways AI can help you take a more active role in your health care.
asserted
you → join → care
You’ll learn how to organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare questions for your next doctor’s visit.
asserted
You → learn → visit
No technical
experience is needed.
asserted
experience → need → ?
Register for free now at CyberGuyLive.com
Florida confirms the DMV data breach
FLHSMV says its investigation traced the breach to credentials belonging to a single Plant City Police Department user.
asserted
investigation → register → user
According to the agency, those credentials were improperly stored on the employee's personal electronic device.
uncertain
credentials → accord → device
A criminal actor was then able to take advantage of them.
asserted
actor → take → them
That explanation gives us the first official account of how the breach occurred.
asserted
breach → give → account
It also differs from the access method ShinyHunters previously described.
asserted
ShinyHunters → differ → method
FLHSMV says it notified the Florida Office of the Attorney General as required under state law.
asserted
it → say → law
The agency is also working with the Florida Digital Service and Florida Department of Law Enforcement.
asserted
agency → work → Enforcement
The criminal investigation remains ongoing.
asserted
investigation → remain → ?
Officials say additional information will be released at an appropriate time.
asserted
information → say → time
What ShinyHunters claims it stole from Florida
ShinyHunters says it stole more than 200,000 driver records from DAVID.
uncertain
it → claim → DAVID
BleepingComputer reported that the group provided a screenshot of a DAVID record belonging to Jeffrey Epstein as evidence that it had accessed the system.
asserted
it → report → system
The screenshot reportedly contained an address, Social Security number, birth date, driver's license information and registered vehicle details.
uncertain
screenshot → contain → address
DAVID can contain far more than a person's basic driver's license information.
asserted
DAVID → contain → information
Government records describing the system show that authorized users may have access to driver information, photographs, signatures, vehicle history, insurance information and other identifying records.
uncertain
users → describe → information
However, FLHSMV still has not disclosed how many records were accessed or stolen.
asserted
records → disclose → ?
The agency also has not confirmed ShinyHunters' claim that more than 200,000 records were taken.
uncertain
records → confirm → claim
CyberGuy reached out to FLHSMV for additional comment, but did not hear back before our deadline.
asserted
CyberGuy → reach → deadline
Florida's findings conflict with the hackers' password-reset claim
ShinyHunters originally told BleepingComputer that it breached DAVID through a password-reset flaw.
uncertain
it → conflict → flaw
The group claimed that weakness allowed it to compromise multiple accounts, allegedly including accounts belonging to DMV employees and an FBI agent.
uncertain
it → claim → employees
ShinyHunters said it then moved through DAVID record IDs and downloaded associated pages and driver files beginning Sept. 3.
asserted
it → say → pages
The group later said it had lost access and believed the password-reset issue was being patched.
asserted
issue → say → access
Florida's investigation now points somewhere else.
asserted
investigation → point → ?
FLHSMV says the attacker took advantage of credentials belonging to one Plant City Police Department user that had been improperly stored on a personal electronic device.
asserted
that → say → device
The agency has not backed ShinyHunters' claim that a password-reset flaw allowed the group to compromise multiple accounts.
uncertain
group → back → accounts
So, for now, the password-reset explanation remains ShinyHunters' version of events, while compromised police credentials are the access method Florida has publicly identified.
asserted
Florida → remain → events
Why Florida's DAVID database holds sensitive information
asserted
database → hold → information
DAVID serves authorized government users rather than ordinary public searches.
asserted
DAVID → serve → searches
FLHSMV says its Bureau of Records manages access to driver records through DAVID for law enforcement and other approved entities.
asserted
Bureau → say → enforcement
The agency also audits users for compliance.
asserted
agency → audit → compliance
…and 56 more, not listed.
The Aporia
