The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a DAVID driver-database breach; according to BleepingComputer, the confirmation came after the ShinyHunters extortion group claimed it had breached the database.

In a statement posted to X, FLHSMV said it learned of the breach on 4 September 2026, that it was quickly mitigated, and that no further breach is ongoing. Investigation found attackers used compromised credentials of a single Plant City Police Department user that had been improperly stored on the employee’s personal electronic device. FLHSMV notified the Florida Office of the Attorney General and is working with the Florida Digital Service and Florida Department of Law Enforcement; further detail withheld pending the criminal investigation.

FLHSMV has not disclosed how many records were accessed. According to BleepingComputer, FLHSMV's finding that a single user's stolen credentials were used differs from how ShinyHunters claimed to have got in.

No Australian nexus identified. (sources: FLHSMV X statement; BleepingComputer) Updated 16 Oct 2026: FLHSMV issued a public notice saying its investigation with the Florida Digital Service and the Florida Department of Law Enforcement found the potentially affected information includes driver licence and motor vehicle data, including document images, and other personal information. It is mailing letters this week to current driver licence and ID card holders who may be affected, offering one year of identity and credit monitoring plus $1 million identity-theft insurance through Sontiq, a TransUnion company.

Because it may not have current addresses for former licence, ID or title holders, it also issued a substitute notice under Florida's breach law (s. 501.171) and asks them to contact the department if no letter arrives.

FLHSMV still has not said how many people are affected and says it has no evidence the data has been misused.

Correction (25 Oct 2026): removed the extortion group's own claims about how many records it took, how it got in and the screenshot it offered as proof; FLHSMV has not confirmed any of them. (source: BleepingComputer)

Correction (27 Oct 2026): the card date has moved from 8 to 11 September 2026, the earliest date its linked sources visibly show (BleepingComputer's report and FLHSMV's statement on X, both 11 September). (source: BleepingComputer)