Florida says attackers entered DMV database with stolen police credentials

What happened

Florida’s Department of Highway Safety and Motor Vehicles has confirmed that its DAVID driver database was breached after attackers used credentials belonging to an employee of a police department. Independent reporting reflects the state’s confirmation and the credential-based access path.

The available information does not establish how long the account was usable, exactly what records were accessed, or whether all claims about the incident’s scale are accurate. That distinction matters: a confirmed intrusion is not the same as a confirmed wholesale extraction of the database.

Organizations that connect to, query, or rely on driver-record systems should treat the event as a warning about trusted third-party access. The immediate concern is not only the stolen account itself, but also whether its permissions, authentication controls, monitoring, and downstream data access were appropriately limited.

Public agencies should review access involving law-enforcement partners and other external users, while affected individuals should rely on official notices for confirmed information rather than speculation about exposed records.

Why this changes the risk

The incident shows how a single compromised employee account can become a route into a sensitive government database. Even without confirmed details about the records accessed or the attacker’s broader activity, the event raises practical questions about identity assurance, least privilege, remote access, and audit coverage for partner accounts.

Agencies often depend on many outside organizations, making shared trust relationships difficult to monitor consistently. A breach involving one police department account may therefore have implications beyond one employee or one jurisdiction. The confirmed facts support a focused access-control review, not assumptions about the full scope of exposure.

Find your role

What to do next