ShinyHunters Claims Theft of 200,000+ Florida Driver Records From State DMV System
The extortion crew says it abused a password-reset flaw in Florida's law-enforcement lookup tool, DAVID, and posted Jeffrey Epstein's record as proof.
Key points
- ShinyHunters, a criminal group that steals data and demands payment, says it broke into Florida's DAVID driver-records system on September 3, 2026.
- The group claims more than 200,000 driver records were copied, including names, addresses, Social Security numbers and vehicle details.
- To prove the theft, the criminals published a screenshot of Jeffrey Epstein's DMV file.
- The entry point was a broken password-reset feature that let them hijack existing accounts, allegedly including one belonging to an FBI agent.
- The group says more state DMV breaches are coming in the weeks ahead.
ShinyHunters says it stole more than 200,000 driver records from Florida's Department of Highway Safety and Motor Vehicles (FLHSMV), first reported by BleepingComputer. The target: DAVID, the Driver and Vehicle Information Database that police and state officials use to pull up any Florida driver's record.
To prove the theft, the criminals posted a screenshot of Jeffrey Epstein's DMV record, showing his address, Social Security number, date of birth, licence number, and registered vehicles. That's the kind of detail identity thieves pay well for.
How did the hackers get in?
They abused a broken password-reset feature. A flaw in how DAVID handled resets let them hijack accounts belonging to DMV staff and, they claim, an FBI agent. Once inside, the group wrote a script that walked through record IDs sequentially, pulling the HTML and images tied to each driver. The breach started September 3, 2026. ShinyHunters told BleepingComputer it's since lost access and that the flaw is being patched.
FLHSMV and the FBI have not publicly commented.
What was actually taken?
DAVID holds far more than a name and photo. Each record can include a home address, Social Security number, date of birth, licence details, insurance records, prior vehicles, parking permits, and every past licence transaction.
Enough, in short, to open credit lines or file a fake tax return.
| Detail | What we know |
|---|---|
| Target system | DAVID (Driver and Vehicle Information Database), run by FLHSMV |
| Records claimed stolen | Over 200,000 |
| Breach start date | September 3, 2026 |
| Entry method | Password-reset flaw used to hijack existing accounts |
| Proof released | Jeffrey Epstein's full DMV record |
Should Florida drivers be worried?
Yes, cautiously. If the 200,000 figure holds, a slice of Florida drivers now have their Social Security numbers and home addresses in criminal hands. Nothing has been dumped publicly yet: ShinyHunters listed FLHSMV on its leak site and is demanding negotiation first.
Practical steps: place a free credit freeze with the three US credit bureaus, watch for tax-refund fraud next filing season, and treat any call claiming to be from the DMV or law enforcement asking to "confirm" personal details as suspect.
Who are ShinyHunters?
ShinyHunters is a name that's been passed around several criminal crews since 2018. We've covered the group 26 times since May 2026, most recently when it dumped 12.9 million Carhartt customer records on August 27 after Carhartt refused a $3.3 million demand.
The current operation targets cloud SaaS environments and has been tied to breaches at Google, Cisco, PornHub and Match Group. Their preferred recent tactic is voice phishing: ringing an employee, posing as IT support, and talking them into entering their password and multi-factor code on a fake login page. That hands over single sign-on access at Okta, Microsoft or Google, and from there into whatever the company runs on Salesforce, Slack or Dropbox.
A source told BleepingComputer the same group is social-engineering other state DMV platforms. ShinyHunters confirmed to BleepingComputer that more breach announcements are coming in the next few weeks.
Arrests have been made over the years, linked to the Snowflake thefts and the PowerSchool breach. The name keeps operating regardless.
The operational detail worth watching here isn't the record count. It's the method: a password-reset flaw in a law-enforcement database that apparently let one script collect records for weeks. If other state DMVs share similar infrastructure, the group's promise of more announcements is the part that should concern agencies more than this one.
