Huge DMV data breach impacted current and former Florida residents

Mitigations included “blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information,” FLHSMV said.

Florida’s investigation is “ongoing,” officials said, but a cybercriminal group called ShinyHunters—which recently claimed credit for hacking the FBI—may have stolen the data. Last month, NBC Miami reviewed a dark web post in which ShinyHunters announced that it had hacked Florida’s DMV and given officials a September 11 deadline to negotiate a fee to stop leaks of the data.

To prove the breach was real, ShinyHunters posted a photo of the “alleged driver’s license for late financier and convicted sex offender Jeffrey Epstein, a former Florida resident,” NBC Miami reported.

But soon after that post was published, ShinyHunters made edits, removing all mentions of Florida, NBC Miami noted. Ian Gray, vice president of intelligence at the threat monitoring company Flashpoint, told NBC Miami this was a likely indication that Florida officials were negotiating with ShinyHunters to prevent a leak of the database.

Police department leaked login

FLHSMV did not mention ShinyHunters in its announcement and did not answer NBC Miami’s questions about the dark web post. In their announcement, officials said they would post an update when more information is available to share publicly.

The hack appears to be unrelated to a major breach of 153 million US driver’s licenses involving a company called IDscan.net last month, NBC Miami reported. But both hacks highlight how easy it is to get access to millions of Americans’ personal information, which will only get easier as AI advances and simplifies the process of scanning for vulnerabilities, NBC suggested.

In Florida’s case, “a criminal actor gained unauthorized access to a department system” by acquiring the “credentials from an employee of a local Florida law enforcement agency, who improperly stored the credentials on an electronic device,” FLHSMV’s FAQ said.