Florida DAVID Database

Florida's Department of Highway Safety and Motor Vehicles says an international cybercriminal organization reached the state's Driver and Vehicle Information Database, known as DAVID, using compromised credentials belonging to a Plant City Police Department user.

DAVID is the system law enforcement and authorized government agencies use to look up driver and vehicle records. The ShinyHunters extortion group claimed responsibility and said it accessed more than 200,000 driver records. FLHSMV has not confirmed that number, and this report treats it as a claim.

Driver and vehicle records as held by the state motor vehicle authority. Public reporting has not enumerated the exact fields, so the specific breakdown is not established here.

What a driver record contains is a matter of public record even where this incident's detail is not: name, address, date of birth, licence number, physical description, licence status and vehicle associations. That is the identity file the state itself uses to confirm who somebody is.

Florida drivers, who have no relationship with Plant City Police Department and no ability to opt out of the database. Holding a licence is the only qualifying condition.

Address data is the acute risk. Driver records have been misused to locate people who moved specifically to avoid being found, which makes this dataset materially dangerous for domestic violence survivors and anyone under a protective order in a way that a marketing leak is not.

Credentialed access with agency accountability is the standard design for law enforcement databases, and it is broadly correct. Officers need rapid lookups, and tying every query to a named user is how misuse is supposed to be caught.

The model assumes the person holding the credential is the person it was issued to. It is built to answer whether this account is permitted to run this query, and it is not built to notice that a permitted account is suddenly running far more queries than police work requires.

How much one credentialed user could extract. A single municipal police account reportedly reached a volume that, if the claim holds, runs to six figures of driver records.

Access control and volume control are different questions, and only the first was answered. The system knew the account was authorized. Nothing appears to have known that authorized use does not look like bulk enumeration.

That is a detection gap rather than a permissions gap, and it is only closeable by somebody having decided in advance what normal looks like for this data. A state that had profiled query patterns per agency would have seen this in hours.

ShinyHunters claimed it, which makes this the third appearance of the group in this series alongside AdaptHealth and the ShipMonk compromise behind the Trezor entry. The consistent theme is reaching a large dataset through a credential belonging to somebody else.

The 200,000 figure is unconfirmed by FLHSMV. A claimed number from an extortion group is an allegation, and treating it as established is how a breach gets misreported at the moment the record is being set.

Rate limiting and anomaly detection on credentialed queries. Nothing here required defeating the access model, so hardening the model would not have helped. Watching how it was used would have.

Second, narrowing what one municipal account can reach. Statewide access for every authorized user is an architecture that makes each individual police credential equivalent to the whole database, and that is a decision about data exposure rather than about policing.