Florida DMV Breach Confirmed via Stolen Police Credentials on Personal Device, ShinyHunters Posts Epstein Record

The breach occurred after an officer stored login details on an unauthorized personal device, allowing the group to extract driver records. FLHSMV notified partner agencies and is working with the Florida Digital Service. ShinyHunters posted sample data including a Jeffrey Epstein record as proof, matching internal FLHSMV formats.

Evidence shows ShinyHunters used AI tools from Anthropic to map systems and escalate access from a single stolen token to broader queries within hours, consistent with their recent operations against Jack Henry and McKesson. This mirrors prior campaigns targeting government and education databases where personal device hygiene failures enabled initial entry.

The incident fits a documented pattern of ShinyHunters exploiting endpoint credential exposure rather than zero-days, bypassing perimeter defenses. Earlier speculation linking it to the IDScan 153-million-record leak was incorrect; the Florida compromise stands alone.

FLHSMV will expand notifications and audits of third-party logins. Expect further state agencies to mandate hardware tokens and device isolation for DMV access within 90 days.