Florida DMV Breach Traced to Police Credentials Stored on a Personal Device

Florida’s motor-vehicle agency suffered a data breach after a criminal actor used credentials assigned to a Plant City Police Department employee, state officials have confirmed.

The Florida Department of Highway Safety and Motor Vehicles, or FLHSMV, learned of the intrusion on September 4. Investigators subsequently determined that the access path involved one police department user whose credentials had been stored improperly on a personal electronic device.

ShinyHunters claimed responsibility on Monday and published images purporting to show information obtained from an FLHSMV system. On Thursday, Florida officials confirmed the group’s claim was legitimate.

The number of people affected remains unknown. FLHSMV has also not disclosed the complete categories of information accessed or established publicly how much data the attacker removed.

A Single Police Account Opened a Path Into State Records

The investigation identified credentials associated with one Plant City Police Department user as the apparent entry point. Plant City is located outside Tampa.

Officials said the credentials had been retained on the employee’s personal device. They have not explained whether the device was compromised by malware, accessed through phishing, searched after a separate account takeover, or exposed through insecure storage or synchronization.

The type of credential is also unknown. FLHSMV has not said whether the attacker obtained a password, browser session, authentication token, API credential, saved remote-access profile, or another form of reusable access.

Those distinctions matter because changing a password alone does not necessarily terminate an attacker’s access. Stolen session cookies and some tokens can remain valid until explicitly revoked, while synchronized password stores may expose credentials for several services.

No software vulnerability, affected product version, or exploit has been identified in connection with the breach. The available evidence instead describes an identity-led intrusion: a criminal used legitimate credentials to enter an environment where the account already had authorized access.

It is not known whether multifactor authentication protected the account. Officials have also not disclosed whether access policies allowed the personal device to connect directly to FLHSMV resources or whether the credentials were used through a separate police system.

ShinyHunters Published an Alleged DMV Record

As evidence of its access, ShinyHunters released images allegedly showing a Florida DMV record associated with Jeffery Epstein, described as an American financier and convicted child sex offender.

The image indicates potential access to at least one motor-vehicle record, but it does not establish the full scope of the compromise. Screenshots can demonstrate that an intruder reached a particular interface or dataset without proving that an entire database was downloaded.

FLHSMV has not reported the total number of affected records. It has not provided a definitive inventory of exposed fields, such as names, addresses, dates of birth, license information, photographs, vehicle details, or other identifiers that motor-vehicle systems may contain.

Whether ShinyHunters exfiltrated additional information beyond the material it displayed is also unconfirmed. No public evidence indicates that ransomware was deployed, and there has been no reported operational disruption to Florida DMV services.

The uncertainty leaves several possible levels of impact. The incident could involve limited viewing through one account, broader searches using the user’s permissions, bulk extraction, or movement into connected systems. FLHSMV has not said which scenario its logs support.

The IDScan Breach Has Not Been Linked to Florida’s Incident

Early speculation connected the FLHSMV compromise to a separate breach at identity-verification company IDScan, which involved 153 million driver’s licenses.

ShinyHunters had previously attempted to purchase the database stolen from IDScan, creating a circumstantial connection between the group and both sets of driver information. However, no evidence currently establishes that the Florida intrusion relied on the IDScan data or formed part of the same compromise.

The distinction is significant. A database obtained from a third-party provider and unauthorized access through a government employee’s account represent different attack paths, even if the resulting information overlaps.

In the Florida case, investigators have attributed access to credentials belonging to a single Plant City Police Department user. Until forensic findings indicate otherwise, the IDScan incident should be treated as separate.

AI Is Part of the Group’s Broader Playbook, but Its Role Here Is Unknown

ShinyHunters has claimed a series of attacks involving technology, healthcare, finance, travel, education and consumer services. Named targets have included Jack Henry, McKesson, Carnival Cruises, Ticketmaster, AT&T, McGraw Hill, ADT and Rockstar.

Other claimed operations affected a widely deployed educational software suite, a major medical-device company and additional large enterprises. In the medical-device case, information concerning more than four million people was reportedly stolen following an attack in April. An educational technology incident caused disruption across the United States in May.

Anthropic published a report on Thursday describing how suspected ShinyHunters affiliates used artificial intelligence during intrusions. The reported activities included identifying credentials, interpreting unfamiliar technical environments and gathering victim information for extortion.

In one case examined by Anthropic, an operator moved from possession of a stolen developer token to full administrative control of a victim’s cloud environment in approximately three hours. Google incident responders separately reported last week that members of the group were using Anthropic tools at multiple attack stages.

There is no confirmation that AI tools were used against FLHSMV. The broader reporting nevertheless illustrates how attackers can combine stolen identities with AI-assisted reconnaissance and technical analysis, potentially reducing the time between initial access and data collection.

AI does not replace the credential in that chain. It can make a valid stolen credential more useful by helping an operator map systems, understand permissions, formulate queries and identify valuable repositories.

The Investigation Has Major Gaps to Resolve

FLHSMV has notified other Florida government offices and is working with the Florida Digital Service. The agency has publicly acknowledged the breach and identified the apparent use of the Plant City employee’s credentials.

It has not disclosed whether the credentials were revoked, passwords reset or active sessions terminated. There is also no public information about endpoint forensics, containment measures, access-log retention, affected-person notifications or changes to authentication controls.

Investigators will need to determine when the attacker first used the account, which resources it queried and whether the activity originated from unusual devices or locations. They must also establish whether the account’s permissions allowed bulk access and whether the intruder created new credentials or persistence mechanisms.

Reviewing adjacent accounts is essential. If the personal device stored one government credential, it may have held others through browser storage, password managers, email, screenshots, notes or synchronized applications.

The incident also raises a governance question: whether law-enforcement personnel may store credentials for state systems on unmanaged devices. If personal-device access is permitted, agencies need enforceable controls covering encryption, device health, credential storage, session duration and remote revocation.

Government and Law-Enforcement Users Should Treat Similar Credentials as Exposed

Organizations whose personnel access motor-vehicle or other government databases should identify accounts used from personal devices and assess them immediately. Credentials stored on unmanaged endpoints should be presumed exposed until the device and associated account activity have been reviewed.

Defensive teams should:

• Revoke active sessions and authentication tokens rather than relying only on password changes.
• Review login, query and export logs for unusual activity involving law-enforcement accounts.
• Look for access from new devices, unexpected locations or atypical hours.
• Examine abnormal record searches, high-volume queries and repeated lookups of prominent individuals.
• Require phishing-resistant multifactor authentication where supported.
• Restrict sensitive systems to managed, compliant devices.
• Prevent credentials from being stored in browsers, notes, screenshots or unauthorized password tools.
• Check whether compromised users had access to additional state or municipal systems.
• Preserve endpoint and authentication evidence before reimaging affected devices.

No specific malicious domains, IP addresses, file hashes or other technical indicators have been released. Organizations must therefore focus on behavioral evidence and account-level anomalies rather than matching public indicators.

For individuals, the immediate risk is difficult to measure because FLHSMV has not identified the affected population or exposed data fields. Any notification obligations and appropriate protective steps will depend on what investigators determine was accessed or removed.

The central fact is already clear: one set of government-authorized credentials, stored on a personal device, was sufficient to create an access route into a state motor-vehicle environment. The remaining forensic work must determine how far ShinyHunters traveled after getting inside.