Florida confirms data breach after an extortion claim against its law enforcement driver license database
The Florida Department of Highway Safety and Motor Vehicles said in a September 11 statement that it learned a data breach "conducted by an international cybercriminal organization." According to the agency, the intruder used a single police department user's credentials improperly stored on the employee's personal device, and the breach was quickly mitigated. The statement did not name the system, but it followed a claim by the extortion group ShinyHunters that it had copied more than 200,000 records from DAVID, the driver and vehicle database used by law enforcement; the sample record the group published showed an address, Social Security number, birth date, license number, and registered vehicles. The state has not confirmed the record count.
ASSESSMENT
Government databases give authorized users access to government-held driver and vehicle records, which residents cannot opt out of and which carry identifiers that cannot be reissued the way a password can. In this case, the reported personal device (we don't know yet if it was a managed BYOD or personal phone) entry route seems strange given the sensitive nature of this data; the number of affected records remains unconfirmed. Aggregated identity and address data can be used for impersonation, fraudulent account openings, and approaches at the home.
TAKEAWAYS
Families with Florida licenses or vehicle registrations should assess their potential exposure and prepare for address-based approaches, impersonation, and fraudulent account openings, not only credit monitoring.
Examine how the family tracks exposure of information and PII it cannot change or request to be removed
Audit staff and vendors with access to family systems keep work credentials on personal devices
