If you hold a Florida driver license, act as though your Social Security number is already circulating: freeze your credit at all three bureaus, lock your SSN, and ignore any DMV text or email asking you to verify details. Florida's FLHSMV confirmed its DAVID driver database was breached in September 2026 after criminals used a stolen police login.
What Happened to Florida's DAVID Database
DAVID — the Driver and Vehicle Information Database — is the FLHSMV system that law enforcement officers use to pull up a driver's record during a stop or investigation. It is not a public database. It contains the full identity file behind a license.
What is confirmed and reported so far:
- FLHSMV says it learned of the breach on September 4, 2026, with activity beginning around September 3.
- Investigators traced the access to compromised credentials belonging to a single Plant City Police Department user, improperly stored on that employee's personal device.
- The extortion group ShinyHunters claims it took more than 200,000 driver records and listed "State of Florida DMV" on its leak site on September 7, with a September 11 deadline attached to a threat to publish the files.
- FLHSMV says the incident was mitigated and is not ongoing, has notified the Florida Office of the Attorney General, and is working with the Florida Digital Service and the Florida Department of Law Enforcement.
A screenshot the group posted as proof showed a DAVID record containing an address, Social Security number, date of birth, driver license number with issuance and expiration dates, and registered vehicles. Treat that as the shape of what was taken.
This Is a Full Identity Kit, Not a Password Leak
A password you can change in 30 seconds. An SSN, date of birth, home address and license number are permanent identifiers — the exact combination needed to open credit accounts, file a fraudulent tax return, or pass a phone-based identity check. Assume this data stays useful to criminals for years, not weeks.
Step 1: Freeze Your Credit at All Three Bureaus
A security freeze blocks new credit accounts from being opened in your name. It is free, it does not affect your credit score, and you can lift it temporarily whenever you apply for something. Do all three separately — Equifax, Experian and TransUnion do not share freezes:
- Equifax: equifax.com/personal/credit-report-services
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
Freeze the credit of any adult in your household with a Florida license, and consider freezing your children's credit as well if their data could sit in related records.
Step 2: Lock Your Social Security Number
Two locks matter, and they are separate from a credit freeze:
- E-Verify Self Lock (myeverify.uscis.gov) stops your SSN from being used in an employment eligibility check by someone else — the mechanism behind employment identity theft.
- A my Social Security account (ssa.gov/myaccount), claimed by you, prevents someone else from creating one in your name and redirecting benefits information.
Also request an IRS Identity Protection PIN at irs.gov/ipin before tax season. Without it, a criminal holding your SSN and date of birth can file a return in your name first.
Step 3: Expect DMV-Themed Phishing and Ignore It
Florida drivers were already being hit with fake "unpaid toll" and "license suspension" texts before this breach. Stolen DAVID records make those messages far more convincing, because the sender can quote your real address, license number or vehicle.
Rules that hold regardless of how legitimate a message looks:
- FLHSMV does not text or email you asking for your SSN, license number or payment details.
- Never pay a "reinstatement fee" or "toll balance" from a link in a message. Go to flhsmv.gov or your toll authority's site directly.
- A caller who already knows your address and license number has not proven they are legitimate — they have proven they read a leaked file.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 4: Watch Your Driving Record and Vehicle Registrations
Because the stolen records include license and vehicle data, watch for fraud that is specific to this breach rather than generic credit fraud:
- Citations or toll violations that are not yours, which can indicate someone presenting your license details to police or to a rental company.
- Unexpected registration or title mail for a vehicle you do not own.
- Insurance quotes or claims referencing drivers or vehicles you do not recognize.
You can request a copy of your own driver record through FLHSMV's official portal to check what it shows, and report anything inaccurate to FLHSMV and your local law enforcement agency.
Step 5: Know Your Rights Under Florida Law and the DPPA
Two legal frameworks apply here and both are worth understanding:
- Florida's breach notification statute requires notice to affected individuals generally within 30 days of determining a breach occurred, plus notice to the Attorney General when more than 500 Florida residents are affected. If you receive a written notice, keep it — it is your documentation for disputes.
- The federal Driver's Privacy Protection Act (DPPA) restricts how driver license data may be obtained and used, and provides for statutory damages when it is misused. If your data is used commercially, that statute is often the relevant hook.
One Florida-specific wrinkle: for decades Florida generated license numbers from a Soundex code built out of your last name, first and middle initial, birth date and sex, rather than issuing random numbers. If your license predates the move toward randomized numbering, the number itself encodes identity details — which is part of why a leaked license number is not a throwaway data point.
Step 6: Shrink the Public Half of Your Profile
Criminals do not work from one file. They combine the breached DAVID record with what is freely published about you — your current address history, phone numbers, relatives and neighbors on people-search sites. That is the half of the problem you can actually remove.
See What a Fraudster Would Find
Run a free PrivacyOn scan to see which data broker and people-search sites currently publish your name, address, phone number and relatives — the context that turns a leaked SSN into a successful impersonation.
PrivacyOn removes your listings from 100+ data broker and people-search sites, then keeps checking: when a broker re-adds you from a fresh public-records feed, we re-submit the removal automatically. 24/7 dark web monitoring tells you when your SSN, email or phone shows up in a breach dump or marketplace, and family plans cover up to 5 people — useful when an entire household shares a Florida address. Pricing starts at $8.33/month.
Frequently Asked Questions
Was my information in the Florida DMV breach?
FLHSMV has not published a public list of affected drivers, and the criminal investigation is ongoing. ShinyHunters claims more than 200,000 driver records, which is a fraction of Florida's licensed drivers — but you will not know your status until FLHSMV notifies you. Because the exposed fields include SSNs, the sensible posture is to freeze your credit now rather than wait for a letter.
What data was exposed in the DAVID breach?
Based on the sample record the attackers published, the exposed fields include full name, home address, Social Security number, date of birth, driver license number with issue and expiration dates, and registered vehicle information. That is a complete identity profile rather than a partial one.
How did hackers get into a law enforcement database?
Not by breaking Florida's systems directly. FLHSMV's investigation found the attacker used valid credentials belonging to one Plant City Police Department user that had been improperly stored on that employee's personal device. Legitimate credentials used from an illegitimate place is the single most common route into sensitive government systems.
Can I get a new Florida driver license number after a breach?
Generally no — a replacement license does not come with a new number, and Florida license numbers have historically been derived from your name, birth date and sex rather than assigned randomly. Because you cannot rotate the identifier, the protective work goes into freezes, locks and monitoring instead.
Should I pay for identity theft protection after the Florida DMV breach?
Start with the free, high-impact actions: credit freezes at all three bureaus, E-Verify Self Lock, an IRS IP PIN and a claimed my Social Security account. Those block the most common fraud paths at no cost. Paid monitoring is worth adding for the watching you cannot do yourself — dark web surveillance and continuous data broker removal, which is what PrivacyOn provides from $8.33/month with coverage for up to 5 family members.
Is the stolen Florida driver data on the dark web?
ShinyHunters listed FLHSMV on its leak site and threatened publication after a September 11 deadline, which is the standard extortion pattern: publish or sell if the target does not pay. Whether every file has been posted, treat the data as out of the state's control and monitor accordingly — once a record is copied, no takedown recovers it.