Florida DMV Confirms Data Breach; What It Means for St. Johns County Drivers

The Florida Department of Highway Safety and Motor Vehicles, the agency that issues every driver license and vehicle registration in the state, has confirmed a data breach discovered Sept. 4, and it has not yet said how many Floridians were affected or what information was taken.

The breach was traced to a police employee's login in Plant City, near Tampa, but the agency's records cover every licensed driver and registered vehicle in Florida, including those in St. Johns County.

What the state has said

Tampa Bay 28 reported Sept. 11 that the agency's investigation found an international cybercriminal organization exploited the credentials of a single Plant City Police Department user whose login information had been improperly stored on a personal electronic device. Plant City is in Hillsborough County, near Tampa.

"The data breach was quickly mitigated and no further breach has occurred or is ongoing," the agency said in a statement carried by the station.

The department said it has given the Florida Attorney General's Office the notice state law requires, and that the Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response. The incident remains under criminal investigation, and officials told the station that additional details would be released at an appropriate time.

Officials did not release details about what information may have been accessed or how many people may have been affected.

The extortion claim that came first

The Sept. 11 confirmation came three days after an unverified claim surfaced. On Sept. 8, the cybersecurity outlet CyberInsider reported that the extortion group ShinyHunters said it had pulled driver and vehicle records from DAVID, the restricted Driver and Vehicle Information Database that Florida law enforcement agencies use to look up drivers. The group had posted a screenshot of what appeared to be a DAVID record on its leak site the day before and set a Sept. 11 deadline for the state to make contact, CyberInsider reported. It told the outlet it got in through a password-reset exploit.

CyberInsider said it could not verify the group's claims, the authenticity of the record it displayed, or whether the data came from a direct compromise, and the state had not confirmed a breach at that point. Tampa Bay 28's account of the state's statement does not name the group or say whether the two accounts describe the same intrusion.

What a St. Johns County driver can expect

Under the Florida Information Protection Act, a government entity that determines personal information was accessed in a breach must notify each affected Florida resident no later than 30 days after that determination, though a law enforcement agency can ask in writing for the notice to be delayed. The law also requires notice to the Attorney General's office for any breach affecting 500 or more people, which is the notice the department says it has already given.

The department's Sept. 11 statement does not address individual notices, and until the agency says which records were involved, it is not known whether any St. Johns County drivers are among those affected.

Sources

https://www.tampabay28.com/news/region-hillsborough/plant-city-police-employee-credentials-led-to-florida-dmv-data-breach-flhsmv

https://cyberinsider.com/shinyhunters-claims-breach-of-florida-dmv-threatens-data-leak/

https://www.flsenate.gov/Laws/Statutes/2025/501.171