FBI Investigating Alleged Driver’s License Theft

The FBI is looking into a suspected black market operation involving stolen driver’s license records. This investigation comes with significant concerns about national security and the potential for identity theft, as millions of personal identification documents might have been affected. Federal authorities are actively pursuing the case.

Most of us have to provide a lot of personal info to the DMV, like our addresses and birth dates, so any breach involving these records is understandably alarming.

Recently, officials in Florida confirmed that the Florida Department of Highway Safety and Motor Vehicles, known as FLHSMV, was the victim of a data breach. The agency was made aware of this incident on September 4 and reportedly took swift action to contain it, stating that no further unauthorized access has occurred since.

This confirmation follows claims from a hacking group called ShinyHunters, which asserts that it accessed Florida’s Driver and Vehicle Information Database, or DAVID, and downloaded over 200,000 driver records.

Florida has yet to confirm whether that number is accurate or specify what exact information was taken. Here’s an overview of ShinyHunters’ claims, Florida’s findings, and what drivers should know moving forward.

Florida Acknowledges the DMV Data Breach

FLHSMV’s investigation traced the source of the breach to credentials from a user in the Plant City Police Department. The agency indicated that these credentials were stored incorrectly on the employee’s personal device, allowing a criminal to exploit them.

This is the first official explanation regarding how the breach occurred and contrasts with the method described by ShinyHunters.

The agency has notified the Florida Office of the Attorney General as mandated by state law. They are coordinating with the Florida Digital Service and the Florida Department of Law Enforcement while the criminal inquiry remains in progress. Further information will be shared when appropriate.

What ShinyHunters Claims It Stole

According to ShinyHunters, they accessed over 200,000 records from DAVID, providing what they claim is a screenshot of a record linked to Jeffrey Epstein as proof. This screenshot allegedly included various sensitive details, such as an address, Social Security number, birth date, driver’s license data, and vehicle registration details.

DAVID can contain more than just basic driver’s license information; it may include photographs, signatures, insurance data, and vehicle histories. However, FLHSMV still hasn’t confirmed the extent of the records compromised.

Efforts to obtain more information from FLHSMV received no response before deadline.

Florida’s Findings Contradict Hackers’ Claims

Initially, ShinyHunters told BleepingComputer that they exploited a password-reset vulnerability to breach DAVID, claiming access to multiple accounts, including those of DMV employees and even an FBI agent. They stated this process began on September 3, but they later indicated their access had been lost due to security measures being implemented.

FLHSMV’s recent findings shift focus, indicating that the attacker leveraged credentials belonging to a single user at the Plant City Police Department, whose credentials were improperly saved on a personal device. This contradicts ShinyHunters’ narrative about exploiting a password-reset flaw.

The Significance of Florida’s DAVID Database

DAVID caters to government users, and FLHSMV manages access for law enforcement and authorized entities, auditing user compliance as part of its procedures.

Florida’s policy considers personal information in motor vehicle records as confidential, which can include Social Security numbers and driver IDs. Such data poses a serious risk for identity theft. Just imagine receiving a call from someone who claims to be a government representative with knowledge of your personal information—it’s frighteningly convincing.

ShinyHunters’ Operations Extend to Other States

Reports have emerged suggesting that ShinyHunters is not just focused on Florida; they may also be targeting DMV systems in other states. According to sources, the group is employing social engineering tactics to gain similar access elsewhere.

Although Florida hasn’t confirmed involvement with breaches in other states, the concern remains because the information held by state motor vehicle agencies is highly valuable for identity theft.

Understanding ShinyHunters

ShinyHunters is known for their extortion activities related to data theft incidents against various companies. This group has been linked to attacks involving high-profile organizations, using tactics like voice phishing to extract login details from unsuspecting employees.

While FLHSMV referred to the attackers merely as an “international cybercriminal organization,” they have not officially identified ShinyHunters. So even though ShinyHunters claims responsibility, there’s still some ambiguity around this attribution.

Precautions If Your DMV Data May Be At Risk

It’s essential to take steps to protect yourself, even without concrete evidence of identity theft. Here are some ways to safeguard your personal information:

1) Freeze Your Credit

Freezing your credit can prevent new accounts from being opened in your name. It’s a simple but effective step you can take.

2) Review Your Credit Reports

Check for any unfamiliar accounts or inquiries. Regularly monitor financial accounts for any unexpected activity.

3) Be Cautious of Florida DMV Messages

Scammers might leverage this breach to trick you into sharing personal information. Verify communications by visiting the official FLHSMV website, rather than clicking on suspicious links.

4) Use Quality Antivirus Software

Strong antivirus solutions can help detect threats posed by phishing attempts or malware.

5) Protect Your Email Account

Use a strong, unique password and enable multifactor authentication. This is crucial, as criminals may use your email to access other accounts.

6) Watch for Identity Theft

Keep an eye on all your important accounts for suspicious activity, and consider using identity theft protection services.

7) Limit Your Available Personal Information

Reducing the amount of personal information that is publicly available can make it much harder for scammers to create convincing scams.

8) Verify Any Future Breach Notices

Since there has been a confirmed breach, be cautious with any future notifications. Always verify them by going directly to official sources.

Key Takeaways

With Florida acknowledging the breach, many questions remain regarding the extent of the information compromised. ShinyHunters’ claims of over 200,000 records taken versus Florida’s explanation of credential misuse presents a complex narrative. Until Florida releases further details, it’s wise to stay vigilant. Regularly check your credit and be cautious of any unexpected communications from the DMV.