Florida DAVID Database: 200,000 Driver Records Claimed by ShinyHunters via a Police Account

> TL;DR: Florida's Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that an international cybercrime organization accessed the DAVID driver database, with the breach discovered September 4, 2026. The ShinyHunters extortion gang claims more than 200,000 driver records stolen. Per the agency, the attacker used compromised credentials belonging to a Plant City Police Department user, "improperly stored on the employee's personal electronic device." ShinyHunters tells a different story: a password reset flaw, access to multiple accounts (DMV employees, an FBI agent), and enumeration of record IDs starting September 3.

Two diverging versions — and why it matters

The official version (one account, credentials stored on a personal device) and the attackers' version (a reset flaw, multiple accounts, mass enumeration) are not cosmetic differences: they demand different remediations. A stolen credential on a personal phone is fixed with BYOD rules and MFA. A password-reset flaw allowing takeover of arbitrary accounts — including an FBI agent's — is a product defect that potentially affects every user of the system.

ShinyHunters' published evidence leans toward an extensive compromise: the group shared a DAVID record for Jeffrey Epstein (personal and vehicle information) and described systematic harvesting by iterating over record IDs. The agency has confirmed neither volume nor method, deferring to an ongoing criminal investigation — the Florida Attorney General, Florida Digital Service, and Florida Department of Law Enforcement are all involved.

Why this matters to you

DAVID is exactly the kind of system found in every B2B SaaS: a high-privilege back office where institutional accounts (customers, partners, authorities, support) access individual records — in your case, employee files, payslips, health data, or identities. The three failures in this incident are the three back-office classics:

What to do

The broader lesson

The same ShinyHunters gang appears across this season's cases (Brevo/Trezor via ShipMonk, the Odido claim, and now Florida). Extortion groups are industrializing: one access, one database, one ransom demand, one public leak on refusal. The question is no longer "are our passwords strong" but "how many records can one compromised account extract overnight, and what stops it."