The Florida Department of Highway Safety and Motor Vehicles confirmed on September 11 that a criminal group broke into its systems using stolen login credentials that a Plant City Police Department employee had stored on a personal electronic device. FLHSMV said it first learned of the intrusion on September 4, and stated that “the data breach was quickly mitigated and no further breach has occurred or is ongoing.” The extortion group ShinyHunters claimed responsibility and posted sample driver and vehicle records as proof of access. FLHSMV has notified Florida’s Attorney General under the state’s breach notification statute and is working with the Florida Digital Service and the Florida Department of Law Enforcement.
Why it matters to the security leader: the point of failure was not the DMV’s own network defenses but a police department employee’s personal phone or laptop, a device the state agency does not manage, patch, or monitor. That is a familiar shape for anyone who has tried to model third-party and BYOD risk: the weakest credential in a shared law-enforcement lookup system belonged to an entirely different agency, and the state had no practical way to see it coming. Shared government databases like this one exist precisely because dozens of local agencies need the same lookup access, which means the attack surface is every one of those agencies’ device hygiene, not just the database owner’s.
The original insight is what FLHSMV did not say. The statement confirms mitigation and law enforcement notification but gives no indication that credential storage on personal devices is banned or technically enforced for the officers who query the system, only that this specific compromised credential was addressed. CyberTech has covered how stolen third-party credentials keep opening doors that a target organization’s own controls cannot reach, and this breach, alongside the 153 million driver’s license records exposed earlier this month, points to identity documents becoming one of the most consistently breached data categories of the year regardless of which system holds them.
Source: FLHSMV official statement
