The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) announced on Friday that it is investigating a significant data breach, marking the second time this month that an organization hosting driver’s license information for millions of Americans has been compromised. The agency stated in a statement published to its website that the breach was conducted by an international cybercriminal organization. While specific details regarding what data was stolen remain scarce, law enforcement agencies are currently investigating the incident, and the department confirmed that the breach has since been contained.
Link to Recent IDscan.net Breach
This announcement follows closely on the heels of a major security failure involving IDscan.net, a vendor that scans driver’s licenses for private companies. Hackers claimed to have stolen 160 million IDs from IDscan.net, including sensitive information belonging to high-profile individuals such as Defense Secretary Pete Hegseth. Although FLHSMV officials indicated that the two hacks do not appear to be directly related, both incidents highlight how cybercriminals are increasingly able to access extremely sensitive personal data with relative ease.
ShinyHunters and Extortion Attempts
The breach was first brought to light last week when ShinyHunters, a known cybercriminal group that hacks targets for sensitive information before extorting payments, announced on its dark-web site that the Florida DMV was their latest victim. NBC News viewed a website associated with the group which gave a deadline of Sept. 11 for Florida to negotiate a fee not to release hacked files. The post included a sample file allegedly from the Driver and Vehicle Information Database showing an image related to late financier Jeffrey Epstein.
Investigation Continues
On Friday afternoon, shortly after FLHSMV published its official statement confirming the breach, ShinyHunters deleted references to Florida from their site. Ian Gray, vice president of intelligence at threat monitoring company Flashpoint, noted that removing a victim from such blogs typically indicates that negotiations are taking place regarding payment for non-disclosure. The FLHSMV did not respond to questions regarding whether they were engaging with ShinyHunters in these discussions, as this newspaper reported in Dashcam Video Shows I.
Broader Cybersecurity Concerns
The Florida incident adds to a growing list of cybersecurity challenges facing state and private entities. On Sept. 3, independent journalist Brian Krebs published an investigation revealing that the hacker group had claimed access to millions of Americans’ licenses through IDscan.net tools. An FBI spokesperson confirmed to NBC News that the agency is investigating the breach at IDscan.net as well.
