TALLAHASSEE, Fla. (WCTV/Gray Florida Capital Bureau) – Questions remain unanswered about the recent hack of a state database.
Last week, the state’s driver and vehicle information system, DAVID, was breached.
It remains unclear whether or not the government will pay the requested ransom – that fact was absent from the Florida Department of Highway Safety and Motor Vehicles statement.
Perhaps most importantly, we now know how the hackers got in. They exploited a personal device that was connected to the database when it shouldn’t have been.
A state spokesperson said a Plant City Police Department employee stored their credentials on a personal device.
Florida politics:
After the breach, a well-known hacking group known as “ShinyHunters” posted on the dark web that they obtained about 200,000 driver licenses, and that they wanted a ransom to delete that data.
Cybersecurity professor Thomas Hyslip said keeping a login on a personal device raises security risks because those devices are much easier to breach than government computers.
“And when their personal device got compromised, the ”ShinyHunters” were able to use that information to access the DAVID system,” Hyslip said. “It really highlights what we call in the industry, shadow IT.”
FLHSMV said they’ve told Attorney General James Uthmeier and would notify the Floridians whose data was stolen.
The hacking group previously said last Friday was the deadline to pay the ransom, but there have been no further updates.
Hyslip said this was likely a random attack and he believes it’s unlikely that the group was specifically targeting the Plant City Police Department.
“But when employees take it upon themselves to use their own devices or a home device or untrusted third party device, it just opens that door to potential compromise,” Hyslip said.
In FLHSMV’s statement, the agency did reference the group of hackers being international. That’s common, Hyslip says, and makes it very unlikely the group can be traced.
And even if they were, extradition is a long shot.
“But (the money) gets moved around so much and it gets taken out usually in a country that we don’t have good relationships with. So the chances of actually getting the information from that (are low),” Hyslip said.
Copyright 2026 WCTV. All rights reserved.
Click Here For The Original Source.
