Florida’s motor vehicle agency is mailing breach notices this week to people whose records may have been stolen, after hackers got into a state system with a local police employee’s login, officials said.
The data that may have been exposed includes driver license and motor vehicle records, document images and other personal information, according to the Department of Highway Safety and Motor Vehicles, WKMG in Orlando reported. Letters are going to current license and ID card holders. The department also posted a substitute notice for people who no longer hold a valid Florida license or ID card, or who once had a vehicle titled in the state, because it may not have current addresses for them. It hasn’t said how many people are affected.
The way in was a password. “A criminal actor gained unauthorized access to a department system” using “credentials from an employee of a local Florida law enforcement agency, who improperly stored the credentials on an electronic device,” the department said in a list of questions and answers, as Ars Technica reported.
The department had been more specific in September. It said then that the credentials belonged to a Plant City Police Department user and had been stored on a personal electronic device, and that the account could reach DAVID, the Driver and Vehicle Information Database that police and approved government agencies use to look up driver and vehicle records, CBS12 reported. No statement from the Plant City police appeared in that report.
The department said it learned of the breach on Sept. 4 and contained it quickly. Its response included “blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information,” the agency said.
People who get a letter are being offered a year of free identity and credit monitoring through Sontiq, a TransUnion company, along with $1 million in identity theft insurance. The department said it had no evidence so far that any of the data had been misused. The Florida Digital Service and the Florida Department of Law Enforcement are investigating with the agency.
State officials have described the intruders only as an international cybercriminal group. ShinyHunters, the group that said last month it had hacked the FBI, has claimed the attack. NBC Miami reviewed a post on the dark web in which the group said it had breached Florida’s DMV and gave officials until Sept. 11 to negotiate a fee to keep the data from leaking.
As proof, the group posted what NBC Miami described as the “alleged driver’s license for late financier and convicted sex offender Jeffrey Epstein, a former Florida resident.”
Then the post changed. ShinyHunters removed every mention of Florida soon after publishing it, NBC Miami reported. Ian Gray, vice president of intelligence at the threat monitoring company Flashpoint, told the station that was likely a sign Florida officials were negotiating with the group to stop a leak. The department did not mention ShinyHunters in its announcement and did not answer NBC Miami’s questions about the post.
The group said it took more than 200,000 Florida driver records. The state has not confirmed that number.
The Florida breach appears to be unrelated to the exposure last month of 153 million U.S. driver’s licenses involving a company called IDscan.net, NBC Miami reported.
Officials said the investigation was ongoing and that they would post an update when they had more information to share publicly.