ShinyHunters claims breach of Florida DMV database

The ShinyHunters extortion gang claims it breached DAVID, an online platform operated by the Florida Highway Safety and Motor Vehicles (FLHSMV) agency, and stole over 200,000 records about Florida drivers.

ShinyHunters added FLHSMV to its data leak site and threatened to publish the allegedly stolen information if the agency did not negotiate. As proof, the group released a screenshot of Jeffrey Epstein’s record in DAVID. The screenshot reportedly included an address, Social Security number, birth date, driver’s license ID, issuance and expiration dates, and registered vehicles.

DAVID, short for Driver and Vehicle Information Database, is used by law enforcement and officials to retrieve driver and motor vehicle information. The system also contains information on license transactions, addresses, insurance, prior vehicles, and parking permits. FLHSMV describes DAVID as the primary reporting mechanism for Fatalities and Serious Bodily Injury (FSBI).

ShinyHunters told BleepingComputer that attackers used a password-reset flaw to compromise multiple accounts allegedly belonging to DMV employees and an FBI agent. They then reportedly accessed records by ID and downloaded associated HTML and images. The group said the theft began on September 3 and that it has since lost access while the flaw is being patched.

BleepingComputer said it contacted FLHSMV and the FBI for comment. A source also claimed that the attackers are targeting other state DMV platforms. ShinyHunters said it expects to announce other breaches in the coming weeks. The group’s name has been associated with data theft and extortion attacks since 2018.