UPDATE 11 September 2026: the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a DAVID driver-database breach; according to BleepingComputer, the confirmation came after the ShinyHunters extortion group claimed it had breached the database.

In a statement posted to X (status 2098239548660514979), FLHSMV said it learned of the breach on 4 September 2026, that it was quickly mitigated, and that no further breach is ongoing. Investigation found attackers used compromised credentials of a single Plant City Police Department user that had been improperly stored on the employee’s personal electronic device. FLHSMV notified the Florida Office of the Attorney General and is working with the Florida Digital Service and Florida Department of Law Enforcement; further detail withheld pending the criminal investigation.

FLHSMV has not disclosed how many records were accessed. According to BleepingComputer, FLHSMV's finding that a single user's stolen credentials were used differs from how ShinyHunters claimed to have got in. No Australian nexus identified.

Primary: FLHSMV X statement; wire: BleepingComputer (11 Sep).

UPDATE 16 October 2026: FLHSMV issued a public notice saying its investigation with the Florida Digital Service and the Florida Department of Law Enforcement found the potentially affected information includes driver licence and motor vehicle data, including document images, and other personal information. It is mailing letters this week to current driver licence and ID card holders who may be affected, offering one year of identity and credit monitoring plus $1 million identity-theft insurance through Sontiq, a TransUnion company.

Because it may not have current addresses for former licence, ID or title holders, it also issued a substitute notice under Florida's breach law (s. 501.171) and asks them to contact the department if no letter arrives.

FLHSMV still has not said how many people are affected and says it has no evidence the data has been misused. Primary updated to the FLHSMV public notice (16 Oct).

Correction (25 Oct 2026): removed the extortion group's own claims about how many records it took, how it got in and the screenshot it offered as proof; FLHSMV has not confirmed any of them. (source: BleepingComputer)