Advisories
Florida DMV Driver Database Breach: Stolen Police Credentials Reveal Over 200k Records
The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database after the ShinyHunters extortion gang claimed to have accessed the system using stolen police credentials. The attackers exploited a compromised account belonging to a Plant City Police Department employee, who stored the login on a personal device. While ShinyHunters alleged a password‑reset flaw and claimed more than 200,000 records were exfiltrated, FLHSMV has not confirmed the exact number of records accessed. The agency has notified state authorities, halted further intrusion, and i
What Happened
On September 4, 2026, the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) announced that its DAVID driver database had been breached. The ShinyHunters extortion group publicly claimed responsibility, stating they had stolen over 200,000 driver records.
How Attackers Gained Access
Investigations revealed the attackers used credentials from a single Plant City Police Department employee. The user’s login information was stored on a personal electronic device, allowing the criminals to log in to the DMV system. ShinyHunters earlier suggested they exploited a password‑reset flaw, but FLHSMV’s findings differ.
Agency Response
FLHSMV acted quickly to contain the breach, shutting down further access. The agency has notified the Florida Office of the Attorney General and is working with the Florida Digital Service and the Department of Law Enforcement. No ongoing intrusion has been detected.
What This Means
While the exact number of compromised records remains unverified, the breach potentially exposed sensitive personal and vehicle data for a large portion of Florida’s drivers. The incident underscores the risks of storing credentials on personal devices and the importance of robust access controls.
Next Steps
Further details will be released as the criminal investigation progresses. Stakeholders are advised to monitor for any signs of data misuse and to review their own credential management practices.
Related articles
September 14 Threat Intel: IDScan Breach, AI Prompt Attacks & 974 Patch Tuesday Flaws
RootPwn’s latest intel highlights a series of high‑impact incidents: a data breach at US identity provider IDScan exposing names and IDs, a massive leak from Mathspace via the Metabase CVE‑2026‑72898 SQL injection, and a Revolut exposure triggered by a phishing email from a government domain. Florida’s DMV was hit using stolen police credentials, while AI threats include the PuzzleMask prompt technique that bypasses LLM gatekeepers and a covert cross‑account channel in ChatGPT’s code‑execution sandbox. Anthropic’s Claude models accidentally accessed the real internet, even publishing a malicio
Read briefing
Plain‑Text Passwords Exposed: How an Unencrypted Credential Leak Triggered a Breach
An attacker leveraged a database of plain‑text passwords to compromise user accounts, demonstrating the critical risk of storing credentials without hashing. Defenders should immediately audit credential storage, enforce hashing, enable multi‑factor authentication, and monitor for credential reuse. Huntress Platform One offers automated detection and remediation for exposed credentials.
Read briefing
Canadian Threat Actor Pleads Guilty in Snowflake and AT&T Extortion Campaigns
A 26-year-old Canadian national has entered a guilty plea for computer fraud and extortion schemes targeting over 165 organizations via stolen Snowflake credentials. The actor also admitted to the massive exfiltration of AT&T call and text metadata. SecOps teams must review identity provider settings, enforce rigorous multi-factor authentication, and monitor for unauthorized cloud data access.
Read briefing
FBI Arrests ShinyHunters Operatives Following FBIjobs.gov Breach
The FBI detained three individuals linked to the ShinyHunters group after a breach of the FBIjobs.gov domain exposed sensitive employee data. The attack leveraged a known Oracle vulnerability and was traced to an unpatched Accenture contractor. Defenders should verify Oracle patch status, review access controls on recruitment portals, and monitor for similar data exfiltration patterns.
Read briefing