Florida DMV Breach: Sensitive Records Exposed for Residents After Credential Theft
Current and former residents face exposure of sensitive identity records after an international group accessed state motor vehicle systems using stolen credentials.
Key points
- The Florida Department of Highway Safety and Motor Vehicles confirmed a breach on 4 September 2026 involving compromised credentials.
- Stolen data includes driver licence document images, motor vehicle records and other personal information for current and former residents.
- The cybercriminal group ShinyHunters is suspected of the intrusion, though the department has not officially confirmed their involvement.
Organisations managing identity verification and fraud risk must account for the exposure of Florida resident data. The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) reported that a malicious actor accessed department records on 4 September 2026. This intrusion involved the use of compromised credentials to enter systems holding sensitive motor vehicle information. The breach impacts both current and former residents of the state.
What data was exposed?
The department confirmed that the stolen information includes driver licence data and motor vehicle records. Crucially, this data set contains document images of licences, alongside other personal details. Law enforcement determined that these specific records were accessed. There is currently no evidence that the stolen data has been misused or sold on underground markets. However, the presence of image files increases the potential for identity fraud.
Who is responsible for the breach?
The FLHSMV identified an international cybercriminal organisation as the perpetrator but did not name the group in its initial statement. According to Ars Technica, the cybercriminal collective ShinyHunters may be responsible for the theft. This group recently claimed credit for hacking the Federal Bureau of Investigation. The department stated it has prompted mitigations and launched an investigation. The probe remains ongoing, with no final attribution confirmed by state authorities.
How are victims being notified?
The FLHSMV is sending notification letters to affected individuals, offering one year of credit monitoring from Sontiq, Inc. However, the department acknowledged it may lack current contact details for many former residents. Those who do not receive a letter can verify if their data was compromised by emailing [email protected]. Some residents reported receiving notices weeks after the breach occurred, citing delays in the notification process.
What immediate actions were taken?
Officials stated they took immediate steps upon discovering the unauthorised access. Mitigations included blocking the unauthorised entry and resetting relevant user credentials. The department also engaged cybersecurity professionals to assist with the response. Additional safeguards were implemented to protect sensitive information from further exposure. The FLHSMV confirmed it issued required notifications to state authorities promptly after the incident was identified.
What affected people can do
Individuals should verify whether their personal records were included in the breach by checking for official correspondence or contacting the department directly. It is advisable to review financial statements and credit reports regularly for unrecognised transactions or new accounts. Consider placing a fraud alert or security freeze with major credit bureaus to restrict new credit applications. Be vigilant against phishing attempts that reference this incident, as attackers often exploit recent breaches to trick victims into revealing more data.
What to do and how to stay safe: Florida DMV
- Monitor bank and credit card statements for unauthorised charges or unusual activity.
- Check credit reports from all three major bureaus for new accounts you did not open.
- Enable multi-factor authentication on online banking and sensitive personal accounts.
- Report any suspicious emails or phone calls claiming to be from the DMV to authorities.
Step-by-step guide: Identity Theft Protection: Answers to Critical Security Questions
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the hackers steal passwords from the Florida DMV?
The department stated that the breach occurred using compromised credentials, but did not specify if user passwords were exfiltrated.
Is there a patch for this vulnerability?
The department confirmed it reset relevant credentials and implemented additional safeguards, but no specific software patch was mentioned.
Can former Florida residents confirm if they were affected?
Yes, former residents can email [email protected] to confirm if their data was stolen, as they may not receive a letter.
