ShinyHunters Leaks 200,000 Florida DAVID Records
Update, Sept. 17: BleepingComputer has detailed what the Epstein screenshot showed — the DAVID record displayed the address, Social Security number, birth date, driver's license ID, issuance and expiration dates, and registered vehicles tied to the name, a measure of how much identifying data DAVID puts at any credentialed user's fingertips. Florida's highway-safety agency has still not disclosed how many records were accessed, what data was exposed, or whether affected drivers will be notified.
The hackers gave Florida a deadline. Florida didn't pay. On Wednesday, the ShinyHunters extortion crew made good on its threat and published hundreds of thousands of files stolen from the state's Driver and Vehicle Information Database — the system Florida law enforcement calls DAVID.
The leak, reported Wednesday afternoon by TechCrunch, is the explosive payoff of a breach the Florida Department of Highway Safety and Motor Vehicles confirmed earlier this month. According to the hackers, they dumped the data for a simple reason: "the victim did not pay a ransom or cooperate and comply" with their demands.
And to prove they had really been inside one of the most sensitive databases in state government, ShinyHunters posted a screenshot it claimed showed a DAVID record associated with the late sex offender Jeffrey Epstein — a name guaranteed to make the breach impossible to ignore.
Photo: Elbert Hampton / Wikimedia Commons (CC0)
A deadline, then a data dump
The timeline of the attack has been assembled from the hackers' own boasts and the state's carefully worded statements — and the two accounts do not agree on every point.
ShinyHunters claims it began downloading DAVID records on September 3. The state says it learned of the breach on September 4 and moved quickly to contain it. FLHSMV has said there is no ongoing breach — the door, as far as the agency knows, is now shut.
On September 7, the group listed "State of Florida DMV" on its dark-web leak site and gave the state until September 11 to negotiate. September 11 came and went. That same day, FLHSMV publicly confirmed the breach, telling reporters that an international cybercriminal organization had gained access through compromised credentials belonging to a Plant City Police Department user.
When no ransom was paid, the group did what extortion crews do: it published. TechCrunch's In Brief item on September 16 — posted at 11:00 a.m. Pacific — reported that the stolen files were now live on the hackers' leak site, and an agency spokesperson did not respond to TechCrunch's request for comment on the published data.
What the hackers took
TechCrunch reviewed a copy of the stolen data, and what it found should worry anyone who has ever bought or sold a car in Florida. The bulk of the leak consists of hundreds of thousands of certificates of vehicle ownership — records that contain the names and addresses of buyers and sellers, along with vehicle identification numbers.
A smaller set of files went further into identity-theft territory: Social Security numbers and other government-issued documents, including non-U.S. passports and immigration papers. Notably, TechCrunch reported that the data it reviewed did not appear to include driver's licenses or people's photos — a small mercy in a breach of a driver database.
ShinyHunters claims it stole more than 200,000 driver records in total. That number has not been confirmed by anyone in Florida state government — a point worth underlining, because everything about the scale of this breach currently rests on the word of the criminals who carried it out.
Two stories about how they got in
This is where the official account and the hackers' account diverge sharply — and the gap between them matters.
FLHSMV's version, delivered through statements to Florida media outlets, is specific and damning in its own way. The agency said the attackers got in using the credentials of a Plant City Police Department user — and that those credentials had been improperly stored on a personal electronic device before they were compromised. In other words, the keys to a statewide driver database were sitting on somebody's personal phone or computer, and a criminal crew found them.
ShinyHunters tells a different story. The group told BleepingComputer it breached DAVID through a password-reset flaw that let it compromise multiple accounts in the system — accounts it claimed belonged to DMV employees and even an FBI agent. The group said it then worked through DAVID record IDs, downloading associated pages and driver files starting September 3, before losing access when it believed the flaw was being patched.
As Fox News noted in its September 16 coverage, the state's explanation "differs from the access method ShinyHunters previously described." One of the two accounts is wrong about the entry point. Neither is reassuring: a database this sensitive was reachable either through credentials carelessly stored on a personal device or through a password-reset weakness the state's own contractor or IT staff had left open.
The Epstein screenshot: how ShinyHunters proved the breach
Extortion crews publish "proof of breach" material to show victims — and future victims — that they are not bluffing. ShinyHunters chose its proof for maximum virality: a screenshot the group claimed showed a DAVID record associated with Jeffrey Epstein, the deceased sex offender who maintained a residence in Florida.
TechPulse USA is not republishing the personal details in that screenshot, and neither did the reputable outlets that covered the leak. But the tactic itself is worth noting. By attaching the breach to one of the most notorious names in American crime reporting, the hackers guaranteed headlines far beyond the cybersecurity press — and put the state of Florida in the position of having to answer questions about a leak it had hoped to contain quietly.
Whether the screenshot is authentic is, strictly speaking, unverified by any independent party. It is the hackers' claimed proof, and should be read as such — a criminal crew's advertisement for its own capabilities.
What Florida isn't saying
For a breach this serious, the state's public statements have been strikingly thin. FLHSMV has not disclosed how many records were accessed or stolen. It has not confirmed ShinyHunters' claim of more than 200,000 records. It has not said what specific information was exposed. And it has not said whether affected drivers will be notified — a question with real consequences for millions of Floridians who may currently have no idea their vehicle-ownership records are circulating on a criminal leak site.
What the agency has said: it notified the Florida Attorney General's office, as required under state law; it is working with the Florida Digital Service and the Florida Department of Law Enforcement; and the criminal investigation remains ongoing. "Further information will be released at an appropriate time in the future," the department told CBS12.
That is the full extent of the public record from the victim. Everything else — the scale, the method, the contents — comes from the hackers and from reporters who reviewed the leaked files.
The agency has not said whether DAVID's access controls ever passed independent security audits — the kind of outside verification now being standardized.
Florida DAVID breach FAQ: how to check if your data was stolen
There is currently no public way to check whether your records were in the leak. Florida's highway-safety agency has not published a notification plan, a hotline, or guidance — and as of Sept. 17 it has not said whether affected drivers will be notified at all.
Until it does, the standard precautions apply: place a free credit freeze with Equifax, Experian, and TransUnion; watch bank and credit statements for unfamiliar activity; consider an IRS Identity Protection PIN at tax time; and report suspected identity theft to the Florida Attorney General's consumer-protection office and the FTC's IdentityTheft.gov.
Vehicle-ownership certificates pair names with home addresses and VINs — exactly the corroborating detail that makes phishing and title fraud more convincing. The smaller cache of Social Security numbers, passports, and immigration documents is the crown jewel of identity theft, and those belong to real people who have not been told their data is out there.
The second driver-ID disaster in a month
The DAVID breach is the second catastrophic compromise of American driver-identity data in a single month — and the two incidents are unrelated, which may be the most alarming detail of all.
Earlier in September, hackers breached IDScan, an identity-verification company, in what was described as a monster hack: the attackers claimed to have stolen 160 million IDs, including — they claimed — the driver's license of Defense Secretary Pete Hegseth. Federal investigations into that breach are ongoing.
Two separate crews, two separate systems, one month. The IDScan breach exposed the identity documents Americans hand over to get verified; the DAVID breach exposed the records the state itself keeps on drivers and vehicle owners. Together they amount to a rolling disaster for the idea that Americans' most sensitive identity data is actually under lock and key.
ShinyHunters, for its part, is no newcomer to this business. An FBI public-service announcement describes the crew as specializing in large-scale data breaches and extortion — a professional outfit that steals first and negotiates second, with publication as the penalty for non-payment. Florida just became its latest case study.
The crew is not the only threat-automation story this month — rogue AI agents have been caught casing the internet for vulnerabilities of their own.
What it means for Florida drivers
The practical stakes are identity theft at scale. Vehicle-ownership certificates tie names to home addresses and VINs — exactly the kind of corroborating detail that makes phishing, title fraud, and synthetic-identity schemes more convincing. The smaller cache of Social Security numbers, passports, and immigration documents is worse: those are the crown jewels of identity theft, and they belong to real people who have not been told their data is out there.
Until FLHSMV says otherwise, Florida drivers are in the dark about whether they are affected. The state has not published a notification plan, a hotline, or guidance — only a promise of further information "at an appropriate time." For a breach built on a single user's credentials stored on a personal device, the silence from Tallahassee is becoming its own story.
The lesson for every other state running a DAVID-style system is blunter: your driver database is only as secure as the least careful person with a login. In Florida's case, that appears to have been one police-department user, one personal device, and credentials that should never have left a government system. The hackers needed nothing more.
Sources: TechCrunch (Sept. 16, 2026); Fox News (Sept. 16, 2026); CBS12/WUTV (Sept. 14, 2026); NBC 6 South Florida (Sept. 11, 2026); BleepingComputer (Sept. 8 and 11, 2026); CyberInsider (~Sept. 8, 2026); Florida Today (Sept. 14, 2026); Florida Department of Highway Safety and Motor Vehicles (flhsmv.gov). Related: our earlier report on researchers tearing down a Flock Safety camera and cracking its encryption key — another front in the fight over who gets to see Americans' data.
Comments
Post a Comment