Florida’s Department of Highway Safety and Motor Vehicles (FLHSMV) said Friday that it’s investigating a data breach, making it the second organization that hosts Americans’ driver’s license information to be hacked this month.
The Florida announcement comes on the heels of another incident, in which a vendor that scans Americans’ driver’s licenses for private companies, IDscan.net, said it was investigating a major data breach of its own. Hackers claimed to have stolen 160 million IDs from the company, including one from Defense Secretary Pete Hegseth, sparking federal investigations.
While the two hacks do not appear to be related, they highlight how cybercriminals, whose jobs keep getting easier thanks to AI, can easily gain access to millions of Americans’ extremely sensitive personal information.
Specifics of what was stolen from the FLHSMV are scant. But the department said in a statement published to its website that the breach was “conducted by an international cybercriminal organization.” Law enforcement is investigating the hack, the agency said, and the breach has since been contained. It’s unclear how long the hackers had access.
Last week, ShinyHunters, a cybercriminal group that hacks targets for sensitive information and then extorts them for a payment to delete it, announced on its dark-web site that the “Florida DMV” was its latest victim.
That website, viewed by NBC News, gave a deadline of Sept. 11 for Florida to negotiate a fee not to release hacked files. It included a single sample file, a screengrab of an image allegedly from Florida’s Driver and Vehicle Information Database, that showed the alleged driver’s license for late financier and convicted sex offender Jeffrey Epstein, a former Florida resident. NBC News was unable to verify the authenticity of the image, which includes Epstein’s alleged Social Security number, former driver’s license number and vehicles registered in his name.
On Friday afternoon, after the FLHSMV published its statement, ShinyHunters deleted references to Florida. It’s not clear why the posting was deleted in this instance, but Ian Gray, vice president of intelligence at the threat monitoring company Flashpoint, said that is often an indication that the state had reached out to the hackers to discuss a potential payment not to leak hacked information.
“When a victim is missing from a blog, it typically means that there was a negotiation,” he said.
The FLHSMV did not respond to questions on whether it was engaging with ShinyHunters.
On Sept. 3, independent journalist Brian Krebs published an investigation that found a hacker group claimed to have hacked a driver’s license scanning company and was selling access to a tool that could access millions of Americans’ licenses.
The company, IDscan.net, did not respond to requests for comment, but said on its website the next day that “an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud.”
An FBI spokesperson confirmed to NBC News that the agency is investigating that breach.
