Florida DMV Confirms Data Breach, Marking Second Driver's License Hack Nationwide This Month

Florida's Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed Friday, September 11, that it suffered a data breach, according to a statement the agency posted on its own website. The agency said it learned of the intrusion on September 4 and that it was carried out by "an international cybercriminal organization," not a lone hacker, according to reporting from Shattered.io on the FLHSMV disclosure.

FLHSMV has stopped short of confirming the scale hackers are advertising. The extortion group ShinyHunters posted a listing on its dark-web site last week claiming to have stolen more than 200,000 Florida driver records from the state's DAVID system, the Driver and Vehicle Information Database that FLHSMV itself describes as "indispensable" for law enforcement and criminal justice lookups, according to Cloaked's review of the claim.

ShinyHunters gave Florida a deadline of September 11 to pay up or see the files released, according to NBC News, which viewed the dark-web posting directly. The listing included one sample file: a screengrab allegedly pulled from DAVID showing a driver's license record for Jeffrey Epstein, the late financier and convicted sex offender who once lived in Florida. NBC News said it could not verify the image's authenticity, which purportedly includes Epstein's Social Security number, old license number and registered vehicles.

Hours after FLHSMV published its statement Friday, ShinyHunters deleted references to Florida from its site. Ian Gray, vice president of intelligence at the threat-monitoring firm Flashpoint, told NBC News that when a victim disappears from a ransom listing, "it typically means that there was a negotiation." FLHSMV did not respond to questions about whether it engaged with the hackers, and no source has confirmed a payment was made.

A Second Breach in the Same Month

Florida's DMV isn't the only place Americans' license data leaked out this month. On September 3, independent journalist Brian Krebs reported that a hacker group had breached IDscan.net, a company that scans driver's licenses on behalf of private businesses, and was selling access to a tool capable of pulling up millions of Americans' IDs.

Hackers claimed to have stolen 160 million IDs from IDscan.net, including one belonging to Defense Secretary Pete Hegseth, according to NBC News, a claim serious enough to trigger federal investigations. IDscan.net has not confirmed that number. The company said on its website that "an unauthorized third party may have accessed and/or copied certain customer information," a notably softer characterization than what hackers are claiming.

NBC News reports the two breaches don't appear connected. Both incidents highlight the same underlying problem: state and private databases holding driver's license data, Social Security numbers and birth dates are proving to be soft targets, and AI tools are making it cheaper and faster for criminal groups to find and exploit them.

DeSantis Pulls the Plug on Flock Cameras

Separately, and on a different front of the same broader debate over who tracks Americans' driving records, Gov. Ron DeSantis ordered the Florida Department of Transportation to strip automated license-plate readers, including Flock Safety cameras, from the State Highway System, according to a memo obtained by the Daily Signal. Local law enforcement has 30 days to remove the devices before the state does it for them.

Flock cameras log license plates and vehicle details across a network of more than 120,000 devices nationwide. Supporters, including many police departments, say the system helps solve crimes fast by tracing where a suspect's car has been. Critics, spanning both the left and right, argue that networking that many cameras together creates a searchable record of nearly everyone's movements, a concern that has produced what the Daily Signal calls "bipartisan backlash."

Asked about the technology, President Trump said the administration is still weighing it. "It's being studied right now," Trump said. "You have pros and cons, right? We'll have an answer soon as to our views on it, in the coming weeks." No federal policy has been announced.

What's Still Unresolved

FLHSMV has not detailed how many records were actually accessed, which systems beyond the initial entry point were touched, or whether Social Security numbers and license photos left the network, according to Shattered.io's review of the agency's public statements. A significant gap remains between what the state confirms and what ShinyHunters claims, one Florida will need to close as its investigation, aided by law enforcement, continues. Whether the state paid the hackers to keep the files offline remains an open question neither FLHSMV nor ShinyHunters has answered on the record.