The password-reset flaw that reportedly handed ShinyHunters an FBI agent's login and 200,000 Florida driver records

On 8 September 2026, the extortion gang ShinyHunters claimed it had breached DAVID, the Driver and Vehicle Information Database operated by the Florida Department of Highway Safety and Motor Vehicles (FLHSMV), the state agency responsible for driver's licences, vehicle registrations, and the records that Florida law enforcement, prosecutors, and licensing officials use every day. The gang told the security outlet BleepingComputer that the intrusion ran from 3 September until FLHSMV patched the flaw it says it exploited. As of publication, FLHSMV had not confirmed the breach.

The entry point, according to ShinyHunters, was a weakness in DAVID's password-reset process. Exploiting it let the group take over multiple legitimate accounts inside the system, accounts it says belonged to DMV employees and, in at least one case, to an FBI agent. No credentials had to be phished, guessed, or bought from a criminal marketplace. The account-recovery mechanism itself was the way in.

Once inside, the attackers reportedly worked through DAVID's records by iterating driver ID numbers, downloading the HTML pages and images tied to each one. Over roughly five days they claim to have pulled more than 200,000 individual driver files, each holding a name, address, Social Security number, date of birth, driver's licence number with its issuance and expiry dates, and a list of registered vehicles. As proof, the group published a screenshot of the record belonging to Jeffrey Epstein, a choice made for attention rather than to demonstrate a technical skill the scale of the theft had already shown.

ShinyHunters added the Florida Highway Safety and Motor Vehicles agency to its extortion leak site on 7 September, calling it a final warning ahead of an 11 September deadline to negotiate. A source told BleepingComputer that the same group is running social engineering attacks against other states' motor vehicle platforms and expects to announce further breaches in the coming weeks. The claim also lands days after researchers uncovered a separate underground service offering scans of more than 153 million driver's licences, sourced from an identity-verification vendor's systems rather than a state agency. Two unrelated pipelines into the same category of government-issued identity document are now reportedly compromised inside the same fortnight.

The defences that failed here were not unusual for a government system of this kind. DAVID sits behind a login, and an account-recovery flow exists so that legitimate users who forget a password are not permanently locked out of a system that law enforcement relies on daily. That recovery flow is precisely what ShinyHunters says it used. A password reset is treated, almost everywhere, as routine account hygiene rather than as the high-impact event it actually is: a mechanism that hands full account control to whoever completes it, regardless of who they claim to be.

A password reset on an account with access to a law enforcement database is an execution event, not a housekeeping task. Under GoFirm, before any reset on a DAVID account tied to a DMV employee or an authorised law enforcement user can take effect, a real-time confirmation request goes out-of-band to that named individual's own registered device, requiring a biometric confirmation before the reset is permitted to proceed. The same control extends to what followed: pulling driver records by the thousand, far outside the pattern of the single lookups a DMV clerk or an FBI agent would normally perform, is itself a high-impact action that should require the same named-authority confirmation before it executes.

Whoever exploited DAVID's password-reset flow, however well it mimicked a legitimate account-recovery request, could not have produced a biometric confirmation from the real DMV employee or FBI agent on a separate, registered device. The execution boundary holds regardless of which flaw in the login process the attacker found.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Abrams, L. 2026. ShinyHunters hackers claim breach of Florida "DAVID" DMV database. BleepingComputer, 8 September 2026.
2. Sharma, S. 2026. ShinyHunters claims Florida DMV breach, puts data on the clock. CSO Online, 9 September 2026.
3. Krebs, B. 2026. FBI probes service selling 153 million driver's licenses. KrebsOnSecurity, 4 September 2026.