Florida confirms breach of driver database DAVID

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed a security breach involving its driver database, known as DAVID. The agency reported discovering the incident on September 4 and stated that the breach has been contained.

There are conflicting reports regarding the method of entry. The FLHSMV attributed the unauthorized access to credentials from a single police officer that were improperly stored on a private device. However, the hacking group ShinyHunters, which claims responsibility for the attack, alleges they exploited a vulnerability in the password reset process to take over multiple accounts, including those belonging to government employees and an FBI agent.

Investigations are currently being conducted by the Florida Attorney General, the Florida Digital Service, and the Florida Department of Law Enforcement.