Florida residents urged to verify driver license details after DMV breach exposes images and personal data

The Florida Department of Highway Safety and Motor Vehicles is notifying individuals whose driver license and motor vehicle records were accessed by a malicious actor. This breach affects both current and former residents of the state. The department confirmed that unauthorized access occurred on September 4, 2026, when an attacker used compromised credentials to enter department systems.

Root cause

According to the Florida DMV, the breach originated from the use of compromised credentials by a malicious actor. The department stated it took immediate steps upon discovering the unauthorized access on September 4, 2026. Law enforcement determined that the accessed information included driver license data, motor vehicle records, document images, and other personal details. There is currently no evidence that the stolen data has been misused.

Attack path

An international cybercriminal organization is believed to be responsible for the intrusion. While the department did not name the group in its initial public statements, officials noted that ShinyHunters may have stolen the data. This group recently claimed credit for hacking the FBI. The attackers gained entry using stolen login credentials, allowing them to access sensitive department records before the breach was detected and mitigated.

Affected versions

The breach impacted records stored by the Florida Department of Highway Safety and Motor Vehicles. It affects data belonging to current and former Florida residents. The compromised information includes driver license details, motor vehicle records, and scanned document images. Personal information associated with these records was also accessed. The department noted it may not have current contact information for many former residents whose data was still stored in its systems.

Mitigation

• Blocking unauthorized access to the affected systems
• Resetting relevant user credentials across the department
• Engaging cybersecurity professionals to investigate the incident
• Implementing additional safeguards to protect sensitive information
• Issuing required notifications to state authorities
• Sending letters to affected individuals with credit monitoring offers

For customers and users

Affected individuals should monitor their financial accounts and credit reports for suspicious activity. Placing a fraud alert or security freeze with major credit bureaus is a recommended precaution. Users should check whether they receive official correspondence from the department. If you are a former resident, verify your status by emailing the provided address. Be wary of follow-up scams asking for personal details or payment for services you already received.

Background: Unauthorized access

Stop unauthorized access by enforcing strict identity verification, minimizing the data surface available to attackers, and continuously monitoring system integrity. This checklist covers identity controls, data protection, and network segmentation to reduce the risk of intrusions.

Read the full guide: Unauthorized Access Prevention Checklist for Systems

What to do and how to stay safe: Florida DMV

• Check your credit reports regularly for unauthorized inquiries or new accounts
• Place a security freeze on your credit files with all major bureaus
• Monitor bank and credit card statements for unfamiliar transactions
• Verify any communication claiming to be from the DMV through official channels

Step-by-step guide: Credit Freezes for Small Business: Protecting Employee Identities

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How do I know if my data was stolen?

The Florida DMV is sending letters to affected individuals. Former residents can email [email protected] to confirm if their data was involved.

What kind of information was taken?

The breach involved driver license data, motor vehicle records, document images, and other personal information belonging to current and former residents.

Is there a fix for this breach?

The department has blocked unauthorized access, reset credentials, and implemented additional safeguards. They are offering one year of credit monitoring from Sontiq, Inc.