Full Report
The ShinyHunters extortion gang claims it breached an online platform for the Florida Department of Motor Vehicles database known as "DAVID" and stole over 200,000 records about drivers in the state. [...]
Analysis Summary
# Incident Report: Breach of Florida DAVID DMV Database
## Executive Summary
The ShinyHunters extortion gang claimed responsibility for a data breach targeting the Florida Department of Motor Vehicles' "DAVID" (Driver and Vehicle Information Database) platform. The threat actors allegedly exploited a password-reset vulnerability to compromise administrative accounts, leading to the exfiltration of over 200,000 driver records. The agency has since reportedly regained control and begun patching the vulnerability while the group threatens to leak the data.
## Incident Details
- **Discovery Date:** September 7, 2026 (Reported by BleepingComputer/Listing on leak site)
- **Incident Date:** September 3, 2026 (Start of breach)
- **Affected Organization:** Florida Highway Safety and Motor Vehicles (FLHSMV)
- **Sector:** Government / Law Enforcement
- **Geography:** Florida, USA
## Timeline of Events
### Initial Access
- **Date/Time:** September 3, 2026
- **Vector:** Exploitation of a flawed password-reset mechanism.
- **Details:** Attackers identified a vulnerability in the DAVID platform’s password-reset flow that allowed them to take over existing accounts.
### Lateral Movement
- **Details:** Using the initial flaw, the threat actors compromised multiple high-level accounts, including those belonging to DMV employees and at least one FBI agent. This provided broad access to the internal search and retrieval functions of the database.
### Data Exfiltration/Impact
- **Details:** The attackers iterated through driver records by ID, automated the downloading of HTML data and associated images. Over 200,000 records were stolen, including Social Security numbers, addresses, birth dates, driver's license IDs, and vehicle registration history.
### Detection & Response
- **Discovery:** Discovered when ShinyHunters listed FLHSMV on their extortion leak site and posted a screenshot of a high-profile individual's (Jeffrey Epstein) DMV record as proof.
- **Response Actions:** FLHSMV reportedly revoked the attackers' access and initiated patching of the password-reset vulnerability.
## Attack Methodology
- **Initial Access:** Exploitation of a password-reset vulnerability in a web application.
- **Persistence:** Compromise of multiple valid employee and federal agent credentials.
- **Privilege Escalation:** Not explicitly detailed, but account takeover of administrative/agent roles provided necessary permissions.
- **Defense Evasion:** Use of legitimate (though compromised) accounts to perform queries.
- **Credential Access:** Password-reset flaw exploitation.
- **Discovery:** Iterating through record IDs to identify valid driver profiles.
- **Lateral Movement:** Compromising multiple accounts across different organizational levels (State DMV and Federal).
- **Collection:** Automated scraping of HTML and image files from the DAVID platform.
- **Exfiltration:** Transfer of 200,000+ records to attacker-controlled infrastructure.
- **Impact:** Extortion/Data Ransom.
## Impact Assessment
- **Financial:** Unknown extortion demand; potential costs for credit monitoring for 200,000 citizens.
- **Data Breach:** High-volume PII (SSNs, DOBs, Home Addresses, Vehicle records).
- **Operational:** Temporary loss of system integrity; emergency patching requirements.
- **Reputational:** High; exposure of sensitive law enforcement data and high-profile citizen records.
## Indicators of Compromise
- **Network indicators:** Listing on ShinyHunters leak site.
- **File indicators:** Not disclosed (Web-based exfiltration).
- **Behavioral indicators:** Unusual volume of record queries/downloads originating from specific employee accounts; abnormal password-reset requests.
## Response Actions
- **Containment measures:** Revocation of compromised account sessions.
- **Eradication steps:** Closing the password-reset vulnerability in the DAVID web application.
- **Recovery actions:** Verification of database integrity and monitoring for further unauthorized access.
## Lessons Learned
- **Key takeaways:** Password-reset mechanisms are high-value targets; even secured databases like DAVID are vulnerable if the application layer has logic flaws.
- **What could have been done better:** Implementation of Multi-Factor Authentication (MFA) that cannot be bypassed by a simple password reset; rate-limiting on record lookups to prevent mass scraping.
## Recommendations
- **Application Security:** Conduct immediate penetration testing of all public-facing and internal web portals, specifically focusing on authentication and account recovery logic.
- **Identity Management:** Enforce hardware-based MFA for all law enforcement and government employee accounts.
- **Anomalous Activity Monitoring:** Implement automated alerts for "bulk" data retrieval that exceeds typical administrative behavior.