Florida’s driver database was breached, then published

DAVID is the database Florida police use at a traffic stop. It pulls a driver’s license record, photo and signature, address history, registered vehicles, insurance and license transactions onto one screen, and it is built to be reached from patrol cars and station desks across the state. That design means logins are held by a great many people in a great many agencies, and the security of the whole system depends on each of them. By the agency’s own account, the break-in did not need a flaw in DAVID at all: it used one Plant City Police Department user’s credentials that had been kept on a personal device. ShinyHunters tell a more technical story, about a password-reset weakness and several hijacked accounts. The agency’s version is the one on the record, and it is also the less comforting one, because a stolen login is a much easier thing to repeat than a software bug.

Two outlets have gone through the archive and described it a little differently. TechCrunch saw mostly vehicle ownership certificates, hundreds of thousands of them, each with the owner’s name, home address and the vehicle identification number, plus a smaller set of records with Social Security numbers and scans of non-US passports and immigration papers. Straight Arrow News counted 594,701 files and described passport scans going back to the 1990s, Social Security cards, permanent resident cards, visas, work permits, vehicle titles, and license photos with signatures. TechCrunch specifically did not find license photos in its copy. Until FLHSMV says what was taken, the careful reading is that the name, address and vehicle details are out for a large group, and more sensitive documents for a smaller one.

There is no way to check yourself today. The archive sits on a criminal leak site, not in any service that indexes breaches, and those services work from email addresses, which a vehicle certificate does not carry. The answer will come from FLHSMV’s letter, which the agency says it will send and which Florida law expects within about a month and a half at most. Until then, the useful question is simpler: do you hold a Florida license, or have you titled a vehicle in Florida? If yes, you are in the population the records were drawn from, and the steps below are cheap enough that it makes sense to take them now rather than wait to find out.

Freeze your credit at Equifax, Experian and TransUnion; it is free, and it is the one step that stops an account being opened rather than telling you afterwards. Request an Identity Protection PIN from the IRS, since a name, address and Social Security number are what a fraudulent tax return needs. If you have not created a my Social Security account at ssa.gov, create one before someone else does it with your number. Ask FLHSMV, or the county tax collector’s office that handles your licensing, whether a duplicate license or a duplicate title has been issued in your name. And if something has already been opened in your name, start at identitytheft.gov: the report it produces is what banks, the IRS and the credit bureaus will ask for.

A stolen vehicle certificate is more useful to a scammer than it looks, because the VIN and plate are details people assume only the state knows. Expect calls and texts that recite them: a registration about to be suspended, a title problem, an unpaid toll, a fine that has to be settled today. Florida drivers were already getting fake toll texts before this, and a message that includes your real vehicle details will be far more convincing. FLHSMV does not collect payments by phone or by text link. Later there will be a second wave about a settlement or compensation, asking for bank details to release money. Nobody legitimate asks for that before a court has approved anything.

Non-citizens who got a Florida license or ID had to show a foreign passport, a green card, a visa or a work permit, and both outlets found scans of exactly those documents in the archive. That group tends to get the least attention in coverage and has the most specific risk: calls from people claiming to be immigration officials, quoting a real document number, saying there is a problem with your status that a fee will fix. US immigration authorities do not ask for payment over the phone or by gift card. If you are in this group, keep copies of your documents somewhere safe, report any misuse of a green card or work permit to the issuing agency, and treat any unexpected call about your status as a scam until you have checked it yourself.

A name and home address were never the secret part of a driver record. Florida’s motor vehicle agency has for years sold driver data to businesses under the exceptions federal law allows, and people-search and data-broker sites publish addresses, relatives and phone numbers built from records like these. What the leak adds is certainty: a stranger can now match a document to a current address. Taking down the broker listings is the step on this page with an effect beyond this news cycle, and it has to be repeated, because listings come back. The general order of things after any breach is in our post-breach guide, and the “pay or leak” hub tracks the other organisations this group has named.