Florida DMV Hacked After Police Dept Insecurely Stored Login Info (arstechnica.com) 13
Florida's DMV says a September 4 breach exposed driver's license and motor vehicle records after attackers obtained credentials that a local law-enforcement employee had "improperly stored on an electronic device." The ShinyHunters group has been linked to the intrusion. Ars Technica reports: In a notice posted Friday, [Florida Department of Highway Safety and Motor Vehicles (FLHSMV)] confirmed that it took "immediate steps" after discovering that "a malicious actor accessed certain department records on September 4, 2026, using compromised credentials." There's "no evidence" that data has yet been misused, the department said, but law enforcement "determined the information potentially affected includes driver license and motor vehicle data, to include document images, and other personal information."
[...] On a webpage describing the security incident, FLHSMV confirmed that an "international cybercriminal organization" was behind the breach but did not specify which group or how long they had access. Instead, officials claimed to have "promptly mitigated the breach, launched an investigation, and issued required notification to state authorities." Mitigations included "blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information," FLHSMV said. Florida's investigation is "ongoing," officials said, but a cybercriminal group called ShinyHunters -- which recently claimed credit for hacking the FBI -- may have stolen the data. Florida residents affected by the breach will receive a letter offering one year of free credit monitoring through Sontiq, Inc. Those whose contact information is outdated can email the FLHSMV at customerinquiry@flhsmv.gov to determine whether their data was compromised.
[...] On a webpage describing the security incident, FLHSMV confirmed that an "international cybercriminal organization" was behind the breach but did not specify which group or how long they had access. Instead, officials claimed to have "promptly mitigated the breach, launched an investigation, and issued required notification to state authorities." Mitigations included "blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information," FLHSMV said. Florida's investigation is "ongoing," officials said, but a cybercriminal group called ShinyHunters -- which recently claimed credit for hacking the FBI -- may have stolen the data. Florida residents affected by the breach will receive a letter offering one year of free credit monitoring through Sontiq, Inc. Those whose contact information is outdated can email the FLHSMV at customerinquiry@flhsmv.gov to determine whether their data was compromised.
Rules for thee but not for me (Score:4, Insightful)
Where's the required multi-factor authentication?
Re: (Score:1)
....attackers obtained credentials that a local law-enforcement employee had "improperly stored on an electronic device."
That's not hacking. You left a door open and someone walked through the open door. They were not hacked. They were stupid and incompetent.
Did this data need to be live-online at all? (Score:1)
How much of this data needed to be "live" and how much of it should've been in "near-line" storage or in offline storage to reduce the risk of bulk-exfiltration?
Re: (Score:2)
Re: (Score:3)
Do you want to go back to old days, when you would sit and wait for some clerk to look up the information manually?
It takes them so fucking long to get back with your license it feels like that's what's happening now.
Re: (Score:2)
about what I expect from Police (Score:3)
Police regularly screw things up. Just another day on the force, where we get Qualified Immunity for being idiots.
Get a printed title for vehicle you own. (Score:4, Interesting)
DMV lose or delete old title records fairly often. Fortunately I had hard copy titles for all my vintage vehicles so getting one reloaded was not a problem.
When I buy a vehicle I get a hard copy of the title printed on the spot, not mailed to me. I've been a mechanic for ~five decades and seen many title problems due to buyers failing to transfer titles then losing their copy (which is the most common error), but don't count on titles in a DMV system to last forever.
Don't omit boat and outboard motor titles where applicable. You can avoid much frustration.
Ah the all soothing make it right (Score:3)
Always ready for a Full Metal Jacket quote: (Score:2)
Fuck that (Score:2)
Florida residents affected by the breach will receive a letter offering one year of free credit monitoring through Sontiq, Inc.
They can get that free from Experian, so... whogivesafuck? That's really just advertising for Sontiq, they are hoping people will sign up after the free year for something they could get for free somewhere else.
(Experian is doing it to try to trick you into buying services by diddling their version of your credit score up and down, sell you access to your other credit scores you can get for free, get you to apply for other lines of credit, etc. But you can do none of that shit and still get free credit moni
The Real Issue (Score:2)
Once again, "everyone" is misunderstanding the problem. You all see that a hacker broke in and stole... You think hacker; bad. You think secret info; leaked. Oh my!
But, contrary to what you might think, the information is not secret. It is readily available to those that pay the states for it. The information is simply paywalled. Doubt me? Ask your favorite insurance company employee. The insurance companies, data aggregators, and others pay the states for this information, and get it.
The real issue in thi
Re: The Real Issue (Score:2)