Breach · · 3 min read
Florida’s DMV was breached with a police employee’s login
Driver licence and vehicle records, including document images, were accessed in September. Former Florida drivers, snowbirds included, may not get a letter.
Florida’s Department of Highway Safety and Motor Vehicles (FLHSMV) says someone used stolen credentials to get into department records on September 4, 2026. Driver licence and vehicle data, including images of documents, may have been taken. Letters started going out the week of October 16. If you ever held a Florida licence or ID, or titled a car there, including as a Canadian snowbird, read on: the state says it may not have a current address for you.
What happened
In its public notice on October 16, FLHSMV said a malicious actor accessed certain department records on September 4 using compromised credentials. An investigation with the Florida Digital Service and the Florida Department of Law Enforcement found that the information potentially affected includes driver licence and motor vehicle data, including document images, and other personal information.
According to the department’s FAQ, as quoted by Ars Technica, the attacker got the credentials from an employee of a local Florida law enforcement agency who had stored them improperly on an electronic device. FLHSMV says an “international cybercriminal organization” was behind it but hasn’t named one. NBC Miami reported that the ShinyHunters extortion group posted a claim about the Florida DMV in September; the department hasn’t confirmed that.
FLHSMV says it has no evidence the information has been misused. It’s offering one year of identity and credit monitoring from Sontiq, a TransUnion company, with $1 million in identity theft insurance.
What this means for you
Driver licence records are the kind of data that makes identity fraud easier: a name, date of birth, address and licence number, and here, document images too. A licence photo or scan is useful for faking an ID check.
The state issued a public notice in addition to letters because it may not have current mailing addresses for people who no longer hold a valid Florida licence or ID, or who previously had a vehicle titled in Florida. That covers a lot of people who have moved away, and a lot of Canadians who spent winters there.
What you can do
- If you held a Florida licence, ID or title and got no letter, ask. FLHSMV says former holders can email customerinquiry@flhsmv.gov. The details and FAQ are at FLHSMV.gov/DataBreach.
- Enrol in the monitoring if you’re offered it. It’s free for one year.
- Freeze or flag your credit in the country where you live. In the U.S., the department recommends a fraud alert or security freeze with the major credit bureaus. In Canada, Equifax Canada and TransUnion Canada offer fraud alerts. See what to do after a data breach in Canada.
- Watch for convincing messages. Someone with your licence details can write a message that looks official. See how scammers use leaked data.
How Frame helps
Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.
Sources
- Florida Department of Highway Safety and Motor Vehicles, Public Notice Regarding September Security Incident, October 16, 2026
- Ars Technica, Florida DMV hacked after police dept insecurely stored login info, October 19, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.