ShinyHunters has named the State of Florida DMV in a new extortion listing, threatening to release files on Sept. 11 and publishing what appears to be a screenshot from Florida’s Driver and Vehicle Information Database, known as DAVID, as purported evidence.
The screenshot reviewed by BreachNews appears to show a DAVID record containing driver’s license information, a photograph and signature, address details and vehicle records. DAVID is maintained by the Florida Department of Highway Safety and Motor Vehicles.
ShinyHunters has not explained how it allegedly obtained the material, how many records it possesses, or whether the files originated directly from FLHSMV. The group recently attempted to acquire a separate collection of driver’s license data associated with the now-offline Nexus identity-data service, raising questions about the provenance of the Florida material.
FLHSMV had not issued any public statement confirming the ShinyHunters claim at time of publication.
Sample appears to show a Florida DAVID record
The purported evidence is more detailed than a driver’s license scan. The interface is labeled DAVID and includes sections for driver history, documents, photographs and signatures, addresses, insurance and vehicle records.
Florida government documentation identifies DAVID as an FLHSMV system used to access driver and motor vehicle information. Records accessible through the system can contain highly sensitive personal information, including names, addresses, telephone numbers and driver identification information.
The sample selected by ShinyHunters is an expired record associated with Jeffrey Epstein. Its use as proof deserves caution because historical Florida driver information associated with Epstein has previously appeared in government investigative material.
A U.S. Department of Justice document from an earlier investigation records investigators checking Epstein’s Florida driver’s license and finding an expired license alongside vehicle and address information. The screenshot therefore does not, by itself, establish current unauthorized access to DAVID or prove that FLHSMV was directly breached.
ShinyHunters claims additional files are available through a download presented as proof, but has not publicly disclosed the number of Florida records allegedly obtained or the complete contents of the archive.
Possible Nexus connection remains unconfirmed
The Florida listing follows ShinyHunters’ public attempt to acquire a much larger collection of U.S. and Canadian driver’s license data associated with Nexus, an identity-data service that subsequently disappeared from the dark web.
BreachNews previously reported on the Nexus dataset, which was advertised as containing access to more than 153 million driver’s license records alongside other identity documents.
ShinyHunters later publicly indicated that it had made multiple substantial offers to acquire the collection. However, there is no evidence establishing that the group successfully purchased it or that the Florida DAVID material originated from Nexus.
The material could instead have originated from FLHSMV, an organization with authorized DAVID access, previously obtained data, or another source. ShinyHunters has provided no technical details establishing how the information was acquired.
Scope of alleged exposure remains unknown
If ShinyHunters possesses current DAVID records rather than previously circulating material, the potential exposure could be significant. Florida law and the federal Driver’s Privacy Protection Act restrict access to and disclosure of personal information contained in motor vehicle records.
However, ShinyHunters has not demonstrated possession of Florida’s entire driver database, and there is currently no basis to conclude that all Florida drivers are affected. BreachNews is also not reproducing sensitive identifiers contained in the group’s sample.
Sept. 11 deadline follows recent ShinyHunters activity
The listing gives Florida officials until Sept. 11 to make contact before ShinyHunters claims it will release the files. It is marked as a final warning and includes a download button for what the group describes as samples.
The Florida DMV listing follows a similar final warning issued against Medela. ShinyHunters has also recently targeted McKesson, Neogen, Jack Henry and Elekta in another group of extortion claims.
ShinyHunters has followed through on previous deadlines by publishing data it claims was stolen from organizations that did not reach an agreement. If additional Florida files are released, they may provide more evidence about the age, scope and source of the material and whether it represents a new compromise or data obtained elsewhere.
BreachNews will update this report if FLHSMV confirms an incident, additional evidence establishes the provenance or scope of the data, or ShinyHunters publishes the files referenced in its listing.
