Florida's DMV (FLHSMV) suffered a major data breach after a local law enforcement employee insecurely stored login credentials, with the cybercriminal group ShinyHunters allegedly stealing personal data of current and former Florida residents.
<p>The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying victims impacted by a recent data breach of driver’s license and motor vehicle data, but not everyone whose information was stolen will receive an alert.</p>
<p>In a <a href="https://content.govdelivery.com/accounts/FLHSMV/bulletins/42f4dc7">notice</a> posted Friday, FLHSMV confirmed that it took “immediate steps” after discovering that “a malicious actor accessed certain department records on September 4, 2026, using compromised credentials.” There’s “no evidence” that data has yet been misused, the department said, but law enforcement “determined the information potentially affected includes driver license and motor vehicle data, to include document images, and other personal information.”</p>
<p>FLHSMV is sending out letters to everyone affected, offering victims one year of credit monitoring from Sontiq, Inc. However, the state acknowledged that it may not have current contact information for many former Florida residents’ whose data was still being stored. Those potential victims can confirm if their data was stolen by emailing FLHSMV at <a href="mailto:[email protected].">[email protected]</a>, officials said.</p><p><a href="https://arstechnica.com/tech-policy/2026/10/huge-dmv-data-breach-impacted-current-and-former-florida-residents/">Read full article</a></p>
<p><a href="https://arstechnica.com/tech-policy/2026/10/huge-dmv-data-breach-impacted-current-and-former-florida-residents/#comments">Comments</a></p>
# Florida DMV hacked after police dept insecurely stored login info
Source: [https://arstechnica.com/tech-policy/2026/10/huge-dmv-data-breach-impacted-current-and-former-florida-residents/](https://arstechnica.com/tech-policy/2026/10/huge-dmv-data-breach-impacted-current-and-former-florida-residents/)
Mitigations included “blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information,” FLHSMV said\.
Florida’s investigation is “ongoing,” officials said, but a cybercriminal group called ShinyHunters—which recently[claimed credit for hacking the FBI](https://arstechnica.com/tech-policy/2026/09/fbi-rushes-to-investigate-if-shinyhunters-hack-of-thousands-of-employees-is-real/)—may have stolen the data\. Last month, NBC Miami[reviewed](https://www.nbcmiami.com/news/national-international/florida-dmv-hacked-drivers-license-breach/3858289/)a dark web post in which ShinyHunters announced that it had hacked Florida’s DMV and given officials a September 11 deadline to negotiate a fee to stop leaks of the data\.
To prove the breach was real, ShinyHunters posted a photo of the “alleged driver’s license for late financier and convicted sex offender Jeffrey Epstein, a former Florida resident,” NBC Miami reported\.
But soon after that post was published, ShinyHunters made edits, removing all mentions of Florida, NBC Miami noted\. Ian Gray, vice president of intelligence at the threat monitoring company Flashpoint, told NBC Miami this was a likely indication that Florida officials were negotiating with ShinyHunters to prevent a leak of the database\.
## Police department leaked login
FLHSMV did not mention ShinyHunters in its announcement and did not answer NBC Miami’s questions about the dark web post\. In their announcement, officials said they would post an update when more information is available to share publicly\.
The hack appears to be unrelated to a[major breach of 153 million US driver’s licenses](https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/)involving a company called IDscan\.net last month, NBC Miami reported\. But both hacks highlight how easy it is to get access to millions of Americans’ personal information, which will only get easier as AI advances and simplifies the process of scanning for vulnerabilities, NBC suggested\.
In Florida’s case, “a criminal actor gained unauthorized access to a department system” by acquiring the “credentials from an employee of a local Florida law enforcement agency, who improperly stored the credentials on an electronic device,” FLHSMV’s[FAQ](https://www.flhsmv.gov/data-breach/)said\.
A dark web service named Nexus is offering access to over 153 million U.S. and Canadian driver's licenses, likely from a breach at identity verification company IDScan, raising national security concerns due to potential use in espionage and identity theft.
Hackers from ShinyHunters claim to have breached FBI systems, stealing data on all FBI employees and applicants, with potential national security implications.
A hacking group called BYOD claims to have breached Trump Mobile, leaking names, addresses, emails, phone numbers, and order data of over 3,600 people after installing a remote access trojan on a Liberty Mobile employee.
The FBI is rushing to investigate claims by hacking group ShinyHunters that they accessed data of thousands of employees using a zero-day exploit in Oracle PeopleSoft, with threats to leak the data if demands are not met.
Hacks of the Pentagon's Defense Manpower Data Center and the FBI within a month exposed sensitive personnel records of millions, including Social Security numbers and intelligence-related job titles that could be exploited by criminal groups or foreign adversaries.