Florida DMV Hacked After Major Driver License Breach
Left 50%
Center 0%
Right 50%
1 left · 0 center · 1 right
What happened
Florida’s Department of Highway Safety and Motor Vehicles (FLHSMV) said Friday that it is investigating a data breach by an “international cybercriminal organization” that it learned of on Sept. 4. Officials said a hacker used credentials belonging to a single Plant City Police Department user that had been “improperly housed on the employee’s personal electronic device.” The agency said the breach has since been contained and that law enforcement is investigating; it did not specify what data was taken or how long attackers had access. Last week the group ShinyHunters posted on a dark-web site that the “Florida DMV” was a victim, displayed a sample image allegedly from Florida’s Driver and Vehicle Information Database showing purported driver’s-license data for Jeffrey Epstein, and set a Sept. 11 deadline to negotiate a fee not to release files. After the FLHSMV statement, ShinyHunters deleted its references to Florida; NBC News said it could not verify the sample image, and the department did not answer questions about whether it was engaging with the group.
Sourcing check · Fully on the record · 2 articles
2 of 2 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 2 of 2
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: FLHSMV, ShinyHunters and Florida Department of Highway Safety and Motor Vehicles
- Primary evidence · cites a document or data 1 of 2
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: official statement, dark-web site post
- Credits another outlet 0 of 2
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 2
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Sep 11, 20:56 UTC by NBC News, naming its source. First document in the first report, from NBC News (official statement).
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out
Unpacked
Left-leaning coverage leaves out how Florida officials say the attackers got in, so the incident reads as a strike on the state DMV itself rather than a leaked police login. Right-leaning coverage reports that officials traced the breach to a Plant City police user's credentials that were "improperly housed" on a personal device. What was stolen stays scant in left-leaning coverage, and NBC News never names that police user or that personal device.
Left-leaning coverage opens by pairing Florida with a separate license-scanning vendor that was hacked the same month. Right-leaning coverage never mentions that other company at all and stays inside the state's own announcement.
Did that police login actually expose Florida's driver database, and what records, if any, left the system?
Bottom line
If you read NBC News on the Florida DMV hack, you missed the state's claim that the door was a police user's personal device, which is the whole Washington Examiner story.
The receipts — 6 facts one side's coverage lacks
- Officials said a hacker used a Plant City Police Department user's credentials improperly housed on a personal electronic device.
- ShinyHunters listed the Florida DMV as a victim and set a Sept. 11 deadline to negotiate a fee not to release files.
- The leak site posted a sample screengrab of an alleged Jeffrey Epstein driver's license from Florida's database.
- Hackers claimed to have stolen 160 million IDs from IDscan.net.
- Florida said it learned of the DMV breach on Sept. 4.
- A Flashpoint intelligence VP said a victim vanishing from a leak blog typically means a negotiation.
The Left View
NBC News framed the Florida announcement as the second driver’s-license data incident this month, coming after vendor IDscan.net said an unauthorized party may have accessed customer information and hackers claimed 160 million IDs, including one belonging to Defense Secretary Pete Hegseth. The outlet said the two hacks do not appear related but “highlight how cybercriminals, whose jobs keep getting easier thanks to AI, can easily gain access to millions of Americans’ extremely sensitive personal information.” It treated ShinyHunters’ posting, the unverified Epstein sample, and the later deletion of Florida from the leak site as the story’s core, quoting Flashpoint’s Ian Gray that a missing victim “typically means that there was a negotiation,” and noting FLHSMV’s silence on whether it was talking to the group.
The Right View
The Washington Examiner reported the announcement as a brief official account, centering Florida’s statement that it learned of the breach on Sept. 4 and that the attacker used one Plant City Police Department user’s credentials “improperly housed on the employee’s personal electronic device.” It did not discuss ShinyHunters, a possible payment, the Epstein sample, or the separate IDscan.net incident.
Our Take (balanced)
The left-leaning account’s strongest argument is that this is not a one-off IT mishap but part of a wider assault on systems that hold Americans’ driver’s-license data: NBC News tied the timing to the IDscan.net incident (hackers claimed 160 million IDs) and treated ShinyHunters’ post and subsequent deletion as signs of extortion, citing Gray that disappearance from such a blog “typically means that there was a negotiation.” The right-leaning account’s strongest argument is the state’s own disclosed vector—a single police user’s credentials on a personal device—and a contained investigation, without confirming a mass leak or a ransom. The central unresolved tension is whether the incident was a narrow credential compromise, as that official description implies, or a successful theft now in undisclosed extortion talks whose contents, duration of access, and any payment FLHSMV has not confirmed.
2 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.