The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has officially acknowledged a data security incident involving its central Driver and Vehicle Information Database (DAVID), after cybercriminals used stolen law enforcement credentials to query and exfiltrate driver profiles.
The breach, first detected on September 4, 2026, has ignited fresh scrutiny regarding how municipal agencies secure authorized external access to sensitive state-level databases containing driver license records, digital photographs, vehicle registrations, and Social Security numbers.
Breach Anatomy: The Personal Device Ingress Vector
According to an incident disclosure published by FLHSMV, the unauthorized queries did not exploit a software zero-day in the core DAVID application architecture. Instead, an investigation conducted in collaboration with the Florida Digital Service and the Florida Department of Law Enforcement (FDLE) traced the activity back to a single user account:
An employee of the Plant City Police Department had stored their official DAVID system credentials on a personal electronic device. When that device was infected by consumer infostealer malware, the adversary scraped browser credential stores and session cookies, gaining frictionless access to the state database under the guise of an authorized police officer conducting routine duties.
When an adversary possesses valid law enforcement credentials, automated access controls view their reconnaissance as standard police business. Traditional perimeter defenses cannot distinguish an attacker from a patrolling officer without device posture verification.
Extortion Group Claims & Exfiltrated Records
The notorious extortion group ShinyHunters claimed responsibility for the intrusion, alleging they obtained over 200,000 driver records spanning residents across the state. To prove their access, the syndicate published screenshots of internal DAVID records belonging to high-profile figures, including the late Jeffrey Epstein, revealing sensitive home addresses, Social Security numbers, license classifications, and vehicle identification numbers (VINs).
ShinyHunters also claimed that they exploited a secondary password-reset loophole allowing broader lateral movement across municipal accounts, though FLHSMV disputed this assertion, insisting that the unauthorized access was confined solely to queries made through the compromised police login and was terminated immediately upon discovery.
Lessons for Law Enforcement & SaaS Identity Governance
The DAVID incident highlights recurring vulnerabilities in how state and municipal public sector organizations grant access to high-value centralized registries:
- Enforce Device Health & Conditional Access: State portals must mandate device compliance checks (e.g. managed MDM certificates and compliant EDR agents) before permitting authentication. Credentials entered from unmanaged personal devices should be rejected unconditionally.
- Phishing-Resistant MFA: Password-based authentication—even when paired with SMS or push OTP—remains vulnerable to session hijacking when an infostealer exfiltrates valid session cookies. FIDO2 / WebAuthn hardware security keys eliminate this risk.
- Behavioral Anomaly & Query Rate Limiting: A municipal officer rarely queries hundreds or thousands of unrelated driver records outside their active jurisdiction within a compressed window. Database auditing systems must flag bulk data harvesting in real time.
FLHSMV confirmed that its investigation remains active, and affected residents whose profiles were improperly viewed will receive formal statutory notifications and identity protection assistance once forensic log analysis concludes.
