One Police Login Opened Florida’s Driver Database

Florida did not lose 150 million driver’s licenses. That number belongs to a private ID-scanning company, and it has its own article. What Florida confirmed is smaller, and in some ways worse: one police login opened the database officers use to pull a driver.

The database

The system is DAVID, the Driver and Vehicle Information Database, run by the Florida Department of Highway Safety and Motor Vehicles, or FLHSMV. It was built so police and court workers can pull a driver or a vehicle on the spot. It is not the public page where you renew a tag. [2]

On the state’s own privacy page, crash history, driving violations, and driver status are treated as public. The blocked set is the sensitive stuff: a Social Security number, the license number, your name, address, phone, and medical details. [3] A 2022 inspector general audit adds the license photo to the highly restricted pile, and says those photos are not handed to private companies. Government users, police included, can see them. [4]

That is why one saved password matters. A gift shop is not supposed to get the photo and the Social Security number out of DAVID. A police account can.

What Tallahassee has said

FLHSMV posted a short notice on September 11, 2026. It says the department learned of the intrusion on September 4, blamed an “international cybercriminal organization,” and says the access was cut off and is not still going. Investigators pointed to one Plant City Police Department user’s login, stored on that employee’s personal phone or computer. The agency called that improper. [1] [8] [11]

The notice also says the attorney general has the breach notice required by section 501.171. FLHSMV named two partners on the response: the Florida Digital Service, and FDLE, the state law enforcement department. It called the case an open criminal investigation and said more would come later. It did not say how many people were hit, which fields were copied, or when letters would go out. [1] [7] [11]

Two stories about the same door

People using the name ShinyHunters told reporters a different version. The same name is attached to a separate FBI jobs-site case. That one is not this breach. [17]

	What Florida has said	What the crew told reporters
How they got in	One Plant City police login, kept on a personal device. [1]	A password-reset hole, and several accounts, including ones they said belonged to motor-vehicle staff and an FBI agent. [6]
How many	Not stated. [1] [7]	More than 200,000 records, with copying they said began September 3. [6]
The sample	No sample released.	A screenshot they said was Jeffrey Epstein’s Florida record. NBC could not verify the image. [6] [8]
After the notice	Access cut. No public answer on whether anyone asked for money. [1] [8]	They later said files went up because Florida would not make a deal. That is their line, not the state’s. [10]

Until FLHSMV publishes its own count, 200,000 is the hackers’ claim, made while they were pressing for a deal. Treat it that way.

NBC reported that on September 11, after the state notice, Florida’s name came off the group’s leak site. Ian Gray of Flashpoint told NBC: “When a victim is missing from a blog, it typically means that there was a negotiation.” The department did not answer questions about talks. [8]

What showed up afterward

• September 3. The crew says this is when the copying started. [6]
• September 4. FLHSMV says this is when it learned of the breach. [1]
• September 8. BleepingComputer reports the 200,000 claim and the password-reset story. [6]
• September 11. The state notice goes up. NBC says the leak-site listing comes down the same day. [1] [8]
• September 14. Straight Arrow News says it counted the posted archive: 475,207 images and 119,494 saved driving-record pages. The reporter described passports, Social Security cards, signed license photos, titles, addresses, birth dates, and DUI notes, including papers from other countries. [9]
• September 16. TechCrunch says the copy it reviewed was mostly vehicle-title paperwork: buyer, seller, address, and the vehicle identification number. Social Security numbers and foreign passports showed up in a thinner slice. That copy did not appear to include license photos. [10]

The state has backed neither description. A pile of files is not a headcount of people. Several documents can belong to one driver. Both newsrooms do agree on the part that matters: material from this police database was copied and posted, and Florida had not, as of those stories, explained the contents itself. [9] [10]

Will you get a letter

Florida law generally requires a letter to each resident in the state whose personal information was accessed, within 30 days of deciding a breach happened. Police can pause those letters in writing if warning people would hurt an investigation. The agency can also ask for 15 more days if it explains the delay in writing. [5]

Count 30 days from September 4 and you land in early October. As of September 28, that ordinary clock had not run out, and the public notice still had no victim list. Silence is not proof you were spared. It is also not proof the department already missed the deadline. [1] [5]

What you can still do

You cannot switch DMVs. If you drive in Florida, the state file is part of driving. A password can be changed tonight. A face, a signature, and a Social Security number cannot. The copies sit there after the headlines move on.

• Freeze new credit at Equifax, Experian, and TransUnion. The FTC says a freeze is free, does not change your score, and blocks new accounts until you lift it for a loan, a lease, or insurance. [12] [14]
• Get an IRS Identity Protection PIN. The IRS page explains how that code makes a bogus tax return easier to stop. [13]
• Ignore fake DMV messages. Do not click a text that claims to be FLHSMV and wants a license number or a Social Security number. Open flhsmv.gov yourself. Do not download the stolen files, and skip sites that offer to search the dump for your name.
• Stop keeping extra copies. Delete photos of your license from your phone, your email, and cloud albums. The state says this started with a password sitting on a personal device. Keep the logins you control in Bitwarden, which publishes its code, not in a note on the phone. If you must send an ID picture, use Signal, then erase both copies. [15] [16]

A freeze does not rewind DAVID. It does make a stolen number harder to spend while those copies sit out there.

---

Sources

1. [1] FLHSMV notice, Sept. 11, 2026: Statement on the data breach
2. [2] DAVID, official page: Driver And Vehicle Information Database
3. [3] Florida driver-privacy page: Driver Privacy Protection Act
4. [4] Inspector general audit, Aug. 1, 2022: Data protection controls for partner agencies
5. [5] Florida statute 501.171: Security of confidential personal information
6. [6] BleepingComputer, Sept. 8, 2026: ShinyHunters claim on DAVID
7. [7] BleepingComputer, Sept. 11, 2026: Florida confirms the police-login path
8. [8] NBC News, Sept. 11, 2026: Florida DMV says it was hacked
9. [9] Straight Arrow News, Sept. 14, 2026: File count from the posted archive
10. [10] TechCrunch, Sept. 16, 2026: What TechCrunch saw in the files
11. [11] CBS12, Sept. 14, 2026: Local report on the Plant City login
12. [12] Federal Trade Commission: Credit freezes and fraud alerts
13. [13] Internal Revenue Service: Get an Identity Protection PIN
14. [14] Freeze a report: Equifax, Experian, TransUnion
15. [15] Bitwarden source code: github.com/bitwarden/clients
16. [16] Signal: signal.org
17. [17] Separate case, this site: ShinyHunters and the FBI jobs site