ShinyHunters claims breach of Florida DMV database, stole 200,000 driver records

Breach Claim and Data Stolen

The ShinyHunters extortion group has announced a breach of the Florida Department of Motor Vehicles' online platform, known as DAVID (Driver and Vehicle Information Database). The group claims to have stolen over 200,000 records belonging to drivers in Florida. As evidence, ShinyHunters released a screenshot of Jeffrey Epstein's DMV record, which included his address and registered vehicles.

DAVID System Details

DAVID is operated by the Florida Highway Safety and Motor Vehicles (FLHSMV) agency and is used by law enforcement and officials to retrieve driver and motor vehicle information. The database contains sensitive details such as addresses, Social Security numbers, birth dates, driver's license IDs, issuance and expiration dates, and registered vehicles. It also includes tabs for additional information like driver's license transactions, insurance, and parking permits.

Method of Attack and Demands

ShinyHunters informed BleepingComputer that they breached the DAVID system by exploiting a password-reset flaw, which allowed them to compromise multiple accounts, including those belonging to DMV employees and an FBI agent. They then allegedly iterated through records by IDs to download associated HTML and images. The group added FLHSMV to its data leak site, threatening to release the stolen data if the agency does not engage in negotiations. ShinyHunters stated they have since lost access to the database, and the exploited flaw is being patched.

Broader Implications

This incident underscores the ongoing threat of data breaches targeting government systems that hold vast amounts of personal information. A source indicated that ShinyHunters is also targeting other states' DMV platforms through social engineering attacks, suggesting a wider campaign. The potential exposure of sensitive driver data could lead to identity theft and other malicious activities.