One Police Login Saved on a Personal Device Opened Florida’s Driver Records. Now the Letters Are Going Out
Florida’s motor vehicle agency has started mailing breach notices after an attacker used a local police employee’s improperly stored credentials to reach driver license and vehicle records. Here is the weak link, what has been confirmed, and what residents and employers should do.
The most important detail in Florida’s driver-records breach is not the size of the database or the name of the gang suspected of taking it. It is how the attacker got in: with one set of valid credentials that belonged to someone outside the agency and had been stored where they should not have been.
Ars Technica reported that the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying people, and the facts below also come from the agency’s October 16 public notice and its September 11 statement.
The weak link
Cause. According to FLHSMV, an attacker accessed a department system using credentials that belonged to an employee of a local law enforcement agency, who had improperly stored them on an electronic device. The agency’s September statement identified the account as a single Plant City Police Department user and said the credentials were kept on the employee’s personal device.
Consequence. The information potentially affected includes driver license and motor vehicle data, document images and other personal information. FLHSMV says it has no evidence so far that any of it has been misused.
Fix. The agency says it blocked the unauthorized access, reset relevant credentials, brought in cybersecurity professionals and added safeguards. It is investigating with the Florida Digital Service and the Florida Department of Law Enforcement.
How it unfolded
- September 4, 2026: FLHSMV says the records were accessed and it learned of the breach that day.
- September 11: the agency publicly confirmed a breach by an “international cybercriminal organization” and said it had notified the state attorney general.
- October 16: a public notice said letters would go out that week to current driver license and ID card holders who may be affected.
- October 19: Ars Technica reports that letters are reaching residents, with some complaining that notice came more than a month after the breach.
What the letters offer
People who are notified get one year of identity and credit monitoring from Sontiq, a TransUnion company, plus $1 million in identity theft insurance. Because the agency may not have current addresses for former license holders or people who once titled a vehicle in Florida, it issued a public substitute notice; Ars reports that those people can email customerinquiry@flhsmv.gov to ask whether their data was involved.
What is still not known
- How many people are affected. FLHSMV has not given a number.
- Who did it. The agency has not named a group. Ars, citing NBC Miami, reports that the ShinyHunters extortion group claimed the hack on a dark web post and set a September 11 deadline, then edited Florida out of the post. FLHSMV has not mentioned ShinyHunters.
- How long the attacker had access, and how the credentials were taken from the device.
If you or your employees live in Florida
- Watch the mail for an FLHSMV letter and enroll in the free monitoring if you receive one.
- If you used to live in Florida or once titled a car there, consider asking the agency whether you are affected.
- Review bank statements and credit reports, and consider a fraud alert or a credit freeze with the major bureaus, as the agency recommends.
- Be wary of calls, texts and emails that mention your license or the breach. Scammers often follow these headlines. The FTC’s guidance is at identitytheft.gov/databreach.
What this means for your company
This breach started with a partner’s login, not a flaw in the agency’s own software, and many small businesses grant similar access to bookkeepers, IT providers, contractors and software vendors. List every outside account that can reach your systems, require multifactor sign-in for all of them (phishing-resistant methods where you can), and give staff and partners an approved password manager so credentials do not end up in notes apps, spreadsheets or personal phones. Review those accounts each quarter and remove the ones nobody uses. If employees drive for work or carry state ID data in your HR files, let them know about the Florida letters so a genuine notice is not mistaken for a scam, or the other way around.
Need help tightening control over partner and contractor access, or responding when employee data turns up in someone else’s breach? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
