One police employee's login, stored the wrong way on a personal device. That's how Florida says an attacker got into the database holding its drivers' records.

Not a vault cracked open. One login.

Ten days after Florida learned of the break-in, the attackers posted the stolen files on the dark web for anyone to download. More than 594,000 of them.

Florida's motor vehicle agency, FLHSMV, says it learned of the breach on September 4, 2026. Its explanation: a criminal actor took advantage of a single Plant City Police Department user's credentials that were "improperly housed" on the employee's personal electronic device.

What kind of device? A phone, a laptop? The state hasn't said. How the attacker pulled the password off it? The state hasn't said that either.

Think about your own devices. A note with a work password. A screenshot of a login screen. A browser that "remembers" everything. Most of us have done one of these at least once.

This time, the bill landed on people who never touched that device.

The database is called DAVID, short for Driver and Vehicle Information Database. Police and approved government agencies use it to pull up anyone's driver and vehicle records in seconds.

So it isn't one agency's system. Many agencies use it, and each one holds keys.

Picture an apartment building where every tenant's staff gets a key card. The building is only as safe as the most carelessly kept card.

That's the state's version: one outside user's login, used by someone else.

The hackers tell a different story. A gang called ShinyHunters claimed the attack and told BleepingComputer it used a flaw in DAVID's password-reset process to take over several accounts, including ones it says belonged to DMV employees and an FBI agent. The gang says it started pulling records on September 3, the day before the state says it noticed. The state has not backed the password-reset claim, and it has never named the gang.

To prove the break-in, ShinyHunters posted one record: Jeffrey Epstein's. It showed his address, Social Security number, driver's license number and a list of his vehicles. Then it threatened to publish everything unless the state negotiated.

The state didn't pay. On September 14, the gang released the archive, telling the world that Florida "failed to reach an agreement" with them.

Straight Arrow News went through the files. What they found:

ShinyHunters claimed "more than 200,000 driver records." The state still hasn't said how many people are affected.

Here's the timing that should bother you. The files went public on September 14. Florida announced its notification letters on October 16. That's 32 days with your Social Security card scan sitting in a public download before the state said a word to you directly.

The state's October notice says it has "no evidence" the information has been misused. It doesn't mention that the files had already been posted for anyone to grab.

The comfortable version of this story is "one officer made one mistake." Don't buy it.

Your data is only as safe as the weakest login at every agency allowed to look you up. You never chose those agencies. You never saw their password habits. And by the state's own account, one login was the way in. Hundreds of thousands of files walked out behind it.

That's not one person's failure. That's a system that trusts every key card equally and never asks why one of them is opening every door in the building.

This is ShinyHunters' whole playbook. Earlier this year, BleepingComputer reported the gang running phone scams where callers pose as IT support and walk employees through handing over their single sign-on login (the one password that opens many work systems) plus the one-time code that's supposed to protect it.

No clever code. People, and the logins they hold.

A source also told BleepingComputer the gang is now going after other states' DMV systems the same way, by tricking people instead of hacking machines.

For IT admins: if one account suddenly pulled 100,000 records from your system, would anything alert you? Find out before someone else does.

I've spent many years in identity, and the pattern never changes. Whether a password comes off a personal device or out of a fake IT-support call, a password plus a texted or emailed code isn't protection. Anyone can read a code to a scammer in seconds. Passkeys and FIDO2 security keys leave nothing to read back: they only work on the real website, from the user's own device. Then layer on adaptive authentication, with machine learning that learns each user's normal devices, locations, hours and lookup volume. An officer who checks five drivers a day shouldn't be able to pull 100,000 without the system stepping in.

Have you ever received a breach letter for data you never handed to that organization directly? How long after the breach did it show up?

Identity Decoded publishes every week at identity-decoded.com