Florida DMV breach exposed driver data of current and former residents

Who is affected

The breach at the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) impacted both current and former Florida residents. The department is sending notification letters to those whose data was confirmed stolen, but officials admit they may not have up-to-date contact details for many former residents. Anyone who lived in Florida and held a driver’s licence or vehicle registration could be at risk. FLHSMV recommends that all current and former residents take precautions, even if they have not received a notification letter.[Ars Technica↗ (opens in a new tab)]

What was taken

According to FLHSMV, the attacker accessed driver’s licence and motor vehicle data. This includes document images and other personal information. The department has not listed every data type exposed, but the information is likely to include names, addresses, licence numbers, and possibly photographs. There is no evidence yet that the stolen data has been misused, but the risk of identity theft is real. To demonstrate the breach, the attackers posted a photo of a well-known former Florida resident’s driver’s licence on a dark web forum.

How the attack worked

FLHSMV’s investigation found that the attacker used credentials belonging to an employee of a local Florida law enforcement agency. These credentials were improperly stored on an electronic device, making them easy to steal. Using these details, the attacker gained unauthorised access to a department system on 4 September 2026. The breach was discovered later, and the department took steps to block access, reset credentials, and bring in cybersecurity professionals. The department has not said how long the attacker had access before being detected.

Who is behind it

FLHSMV described the perpetrator as an “international cybercriminal organisation” but did not name a group. However, NBC Miami reported that ShinyHunters, a well-known cybercrime group, claimed responsibility in a dark web post. ShinyHunters allegedly gave Florida officials a deadline to negotiate a fee to prevent the release of the data. After initial publicity, the group edited its post to remove references to Florida, which some experts believe suggests negotiations may have taken place. FLHSMV has not confirmed or denied these details and did not answer questions about the dark web post.

The response

FLHSMV said it acted immediately after discovering the breach. Actions included blocking unauthorised access, resetting user credentials, and hiring cybersecurity professionals. The department is offering one year of credit monitoring to victims through Sontiq, Inc. The state’s investigation is ongoing, and officials have promised to update the public when more information is available. FLHSMV also recommends that all residents monitor their financial accounts, check credit reports, and consider placing a fraud alert or security freeze with major credit bureaus. Some residents criticised the delay in notification, as the breach occurred over a month before letters were sent.

What you should do

If you are a current or former Florida resident, monitor your financial and credit accounts for suspicious activity. Consider placing a fraud alert or security freeze with credit bureaus. If you have not received a notification letter but are concerned, you can contact FLHSMV to check if your data was involved. Stay alert for further updates from the department as the investigation continues.