Florida Will Mail Letters to Drivers Exposed in DAVID Database Breach, Offering a Year of Free Credit Monitoring

The Florida Department of Highway Safety and Motor Vehicles says it will begin mailing letters this week to drivers whose records may have been exposed in last month's breach of the state's Driver and Vehicle Information Database, known as DAVID, and will offer them a year of free identity and credit monitoring plus $1 million in identity theft insurance. The agency announced the plan late Friday, Oct. 16, more than five weeks after it says it learned of the breach.

It is the first substantive update since September, when FLHSMV disclosed that an international cybercriminal organization had gotten into DAVID using the login credentials of a single Plant City Police Department user. The agency still has not said how many Floridians are affected. A hacking group known as ShinyHunters has claimed it took more than 200,000 driver records; the state has not confirmed that figure.

What FLHSMV announced

In a statement released at 5:25 p.m. Friday, reported by Florida Politics, the department said it will send letters this week to current driver license or identification card holders potentially affected by the breach. To protect those people's identities, the agency said it has partnered with Sontiq, Inc., a TransUnion company, to provide complimentary identity and credit monitoring services and $1 million in identity theft insurance for one year.

The agency also gave a path for people who may not be reached by mail. Anyone who does not receive a letter and previously held a Florida driver license, Florida identification card or Florida title can contact FLHSMV at customerinquiry@flhsmv.gov.

FLHSMV said it has no evidence so far that the information was misused.

How the breach happened, according to the state

DAVID is the system law enforcement officers and authorized government agencies use to look up driver and vehicle records. In a statement first posted Sept. 11, FLHSMV said it learned of the breach on Sept. 4 and that it was quickly mitigated, with no further breach occurring or ongoing.

The department said its investigation determined that a criminal actor took advantage of a single Plant City Police Department user's credentials that were improperly housed on the employee's personal electronic device. FLHSMV said it notified the Office of the Attorney General as required by Florida's data breach law and is working with the Florida Digital Service and the Florida Department of Law Enforcement. Because the matter is an ongoing criminal investigation, the agency said, further information would be released at an appropriate time.

Florida Politics reported there is no indication the police user faced any sanction.

What the hackers claim

ShinyHunters, an extortion group that has claimed numerous large data thefts, said it accessed the data on Sept. 3, one day before the state says it learned of the breach. According to Florida Politics, the group gave FLHSMV a Sept. 11 deadline to make a deal or see the data released. The department's statements make no mention of any attempt to get the data back.

The group has claimed more than 200,000 Florida driver records, a number the state has not verified. ShinyHunters has also told the tech publication BleepingComputer that it got in through a password-reset weakness that let it compromise accounts, an account that differs from the state's explanation of a single set of stolen credentials. Florida Politics described the breach as exploiting a password-reset weakness that the agency characterizes as an issue of compromised credentials.

The state has said the exposed data included driver license and motor vehicle information along with other personal information, but has not released a detailed list of the data fields involved.

Why the timing matters

Florida's data breach statute, section 501.171, applies its notice requirements to government agencies as well as businesses. It requires notice to each affected individual as expeditiously as practicable and no later than 30 days after an entity determines a breach occurred, unless a delay is authorized. The law allows that notice to be delayed if a law enforcement agency determines in writing that notifying people would interfere with a criminal investigation. An entity can also receive 15 additional days if it shows good cause in writing to the state.

FLHSMV has not said publicly whether investigators requested a delay. Its announcement came 42 days after Sept. 4, the date it says it learned of the breach. Breaches affecting 500 or more Floridians must also be reported to the Department of Legal Affairs, which the agency says it did.

What drivers can do now

The monitoring and insurance are free for one year, according to the agency. Its Friday statement did not explain how to enroll in the Sontiq service other than through the letters, and it did not say how long people will have to sign up.

Beyond enrolling, consumer protection steps commonly recommended after a breach involving driver records include watching credit reports and financial statements for unfamiliar activity, and considering a free credit freeze with each of the three national credit bureaus, which blocks new accounts from being opened in a person's name. Drivers should also be cautious about unexpected calls, texts or emails that cite their license or vehicle details, since stolen records are often used to make scams look legitimate. FLHSMV's letters will come by mail, and the agency has not said it will contact people by phone.

A breach at the center of Florida's driver data

DAVID holds records for Florida's licensed drivers and registered vehicles and is used daily by police agencies across the state. The breach came weeks before FLHSMV rolled out newly designed driver licenses and identification cards on Sept. 29, a change unrelated to the hack.

FLHSMV has not said whether it has changed how local agencies access DAVID, or whether it now requires additional verification for logins.

What's next

Letters are expected to begin arriving in mailboxes in the coming days. FLHSMV, FDLE and the Florida Digital Service are continuing their investigation, and the agency has said more details will follow when appropriate. Key questions remain unanswered, including how many people were affected, exactly what information was taken, and whether ShinyHunters has published any of the data.

Floridians who previously held a license, ID card or title and do not receive a letter can email customerinquiry@flhsmv.gov to ask whether their records were involved.