Florida Motor Vehicle Database Breach: What the ShinyHunters Leak Exposed

The ShinyHunters hacking group published hundreds of thousands of files from a Florida state database containing vehicle and driver information. The group said it released the stolen data on its leak site because the victim did not pay a ransom or comply with its demands.

The database is known as DAVID, and the hackers said they breached it earlier in September. TechCrunch reported that the group posted a screenshot as evidence, purporting to show a record associated with Jeffrey Epstein, who had a residence in Florida.

According to TechCrunch’s review of a copy of the stolen data, the hackers took hundreds of thousands of certificates of vehicle ownership records. Those records included vehicle owners’ names, addresses of buyers and sellers, and vehicle identification numbers.

A smaller number of files reportedly included Social Security numbers and other government-issued documents, such as non-U.S. passports and immigration papers. TechCrunch said the files did not appear to contain driver’s licenses or people’s photos.

The Florida motor vehicle agency, FLHSMV, confirmed a data breach in a statement last week, according to TechCrunch. The agency said the breach followed hackers obtaining a police officer’s credentials that were stored on a personal device.

TechCrunch reported that an agency spokesperson did not respond to its request for comment on Wednesday about the published data. For affected people, the key takeaway is to treat vehicle ownership details, addresses, and any government-document exposure as sensitive information that could be misused.

The incident adds to a wider run of driver-data security concerns. TechCrunch noted that the Florida breach came in the same month as a hack at identity verification company IDScan, where hackers stole over 150 million images of driver’s licenses.

The Florida case also highlights a common risk point: credentials stored on personal devices can become a path into sensitive government systems. Organizations handling vehicle, identity, or law-enforcement-linked records should treat credential storage, access controls, and data monitoring as frontline security priorities.