Florida motor-vehicle agency offers 1 year of monitoring after breach

Florida’s Department of Highway Safety and Motor Vehicles said in an Oct. 16 public notice that a malicious actor accessed records on Sept. 4 and affected people will receive one year of credit monitoring.

The incident matters because license records can support identity fraud, and NBC Miami reported it appears unrelated to a separate breach involving 153 million U.S. driver’s licenses tied to IDscan.net last month.

FLHSMV said it took “immediate steps” after discovering that “a malicious actor accessed certain department records on September 4, 2026, using compromised credentials.” The department said there is “no evidence” the data has been misused.

The agency said law enforcement determined the potentially affected information includes driver license and motor vehicle data, document images and other personal information. FLHSMV said it is sending letters to affected people and offering one year of credit monitoring from Sontiq Inc.

The notice may not reach everyone whose information was exposed. FLHSMV said it may not have current contact information for former Florida residents whose data remained in its systems, and said those people can contact the agency by email to check whether their information was affected.

In a webpage on the incident, FLHSMV attributed the breach to an “international cybercriminal organization” but did not identify the group or say how long the access lasted. The agency said its response included blocking unauthorized access, resetting relevant credentials, hiring cybersecurity professionals and adding safeguards.

The department’s FAQ said a criminal actor obtained credentials from an employee of a local Florida law-enforcement agency who had improperly stored them on an electronic device. FLHSMV said its investigation is ongoing and that it would publish an update when more information can be shared publicly.

Ars Technica reported that the cybercriminal group ShinyHunters may have stolen the data, citing NBC Miami’s review of a dark-web post in which the group said it hacked Florida’s DMV and set a Sept. 11 deadline for negotiations. FLHSMV did not mention ShinyHunters in its public announcement, according to Ars Technica.

FLHSMV advised current and former Florida residents to monitor financial accounts, review credit reports and consider a fraud alert or security freeze with major credit bureaus. Ars Technica reported that some residents complained they received notice more than a month after the Sept. 4 access.

Source: Public notice and FAQ, Florida Department of Highway Safety and Motor Vehicles, Oct. 16; Ars Technica, Oct. 19.