ShinyHunters Publishes Florida DAVID Motor Vehicle Data

ShinyHunters has published hundreds of thousands of files taken from Florida's Driver and Vehicle Information Database, known as DAVID, the statewide system for vehicle and driver information TechCrunch.

The group said it breached DAVID earlier in September 2026 and posted the data to its leak site after the victim did not pay a ransom or cooperate and comply with demands. The publication follows a short escalation window. ShinyHunters first threatened to release allegedly stolen Florida DMV records, then claimed to hold more than 200,000 driver records, before posting what is now described as hundreds of thousands of files.

Florida's Highway Safety and Motor Vehicles agency, FLHSMV, confirmed a breach involving DAVID in a statement released in September 2026. The confirmation aligns the state account with the attackers' claim on the system affected, if not on the exact volume exfiltrated.

The vector was not exotic. FLHSMV said hackers obtained a police officer's credentials that were stored on a personal device. That detail matters for practitioners. DAVID is a queryable law enforcement interface, not a public web application. Access depends on authenticated users and role-based permissions. Compromise one endpoint with stored credentials and the database inherits that trust.

What was published is largely vehicle title paperwork at scale. The stolen set included hundreds of thousands of certificates of vehicle ownership containing names and addresses of buyers and sellers, along with vehicle identification numbers. For anyone working in fraud, identity resolution, or data brokerage, that combination is functional. Name plus address plus VIN links a person to an asset, a location history, and a transaction counterpart.

A smaller subset carries higher severity. A smaller number of files included Social Security numbers and other government-issued documents such as non-U.S. passports and immigration papers. The data reviewed did not appear to contain driver's licenses or people's photos. That distinction limits some forms of direct impersonation but does not reduce exposure for phishing, account takeover, or synthetic identity construction.

As evidence of access, ShinyHunters posted a screenshot purporting to be a DAVID record associated with Jeffrey Epstein. The tactic is familiar. High-profile records are used to force press coverage and pressure victims during extortion negotiations.

The broader context here is credential sprawl around sensitive state systems. Centralized driver and vehicle repositories concentrate risk by design. Thousands of authorized users need lookup capability for stops, investigations, and administrative work. Each credential becomes a potential pivot point, especially when authentication material leaves managed devices and lives on personal hardware without phishing-resistant MFA, session controls, or endpoint posture checks.

Looking at what this means for operators of similar systems, the fix is architectural rather than awareness training. Short-lived credentials, hardware-backed authentication, device attestation before database access, and anomaly detection on bulk queries would raise the cost of this exact path. Title and registration data will remain valuable to criminals because it is structured, accurate, and durable. The long opportunity is to make centralized access harder to borrow and easier to revoke, which would leave this kind of bulk leak less repeatable.