ShinyHunters Claim Theft of 200,000 Records from Florida DMV Database
Summary
ShinyHunters claim they used a password-reset flaw to access Florida’s DAVID driver database and steal over 200,000 records. The group says it has lost access and the flaw is being patched; the breach claims have not been confirmed.
Key points
- ShinyHunters claim they breached the Florida Department of Highway Safety and Motor Vehicles’ DAVID driver database and stole more than 200,000 records.
- The group says a password-reset flaw let it compromise multiple accounts, allegedly belonging to DMV employees and an FBI agent.
- ShinyHunters claim they accessed records by iterating through IDs and downloading associated HTML and images.
- The group released a screenshot of Jeffrey Epstein’s DMV record as purported proof; the article says it included sensitive personal and vehicle information.
- ShinyHunters say they lost access to the database and that the password-reset flaw is being patched. Florida’s agency and the FBI had not responded at publication.
- A source told BleepingComputer that the group was targeting other states’ DMV platforms using social engineering; ShinyHunters said it expected to announce more breaches.
Article Details
- Victim Organization
- Florida Highway Safety and Motor Vehicles (FLHSMV)
- Incident Type
- Claimed database breach involving a password-reset flaw, compromised accounts, and alleged data exfiltration
- Data Types Exposed
- Addresses
- Social Security numbers
- Dates of birth
- Driver's license IDs and issuance and expiration dates
- Registered vehicles
- Driver's license transactions
- Insurance information
- Prior vehicles
- Parking permits
- Affected Records
- More than 200,000 driver records, according to ShinyHunters; not independently confirmed in the article.
- Operational Impact
- ShinyHunters said it had lost access to the database and that the password-reset flaw was being patched. The article reports no other operational impact.
- Ransom Or Extortion
- ShinyHunters listed FLHSMV on its leak site and threatened to leak the allegedly stolen data unless the agency negotiated. The group released a screenshot of Jeffrey Epstein’s DMV record as purported proof.
- Claim Status
- claimed