Current and former Florida residents face a massive security incident following a major data breach at the state's motor vehicle department. According to Ars Technica, the Florida Department of Highway Safety and Motor Vehicles revealed that a criminal gained entry to department systems using stolen login credentials.
Key takeaways
- A criminal actor gained unauthorized access to a department system using compromised login credentials.
- The stolen credentials came from an employee of a local Florida law enforcement agency who stored them improperly on an electronic device.
- A cybercriminal group known as ShinyHunters may be responsible for the theft of the database.
- Mitigation steps involved blocking unauthorized access, resetting credentials, and hiring cybersecurity professionals.
What caused the Florida DMV data breach?
According to Ars Technica, the security breakdown happened because a local law enforcement employee stored login credentials improperly on an electronic device. An unauthorized person grabbed those credentials and broke into a department system.
State officials reported taking several steps to fix the problem. Mitigations included blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information.
Who is behind the ShinyHunters hack?
State officials did not name any hacker group in their official announcement. Ars Technica reports that a cybercriminal outfit called ShinyHunters may be behind the attack. This same group recently claimed credit for hacking the FBI.
Last month, NBC Miami reviewed a dark web post where ShinyHunters stated they had breached the state's system. The group gave officials a September 11 deadline to negotiate a fee to prevent leaks. To prove the hack, the group posted a photo of the alleged driver license belonging to the late financier and convicted sex offender Jeffrey Epstein.
What happens next?
The state investigation remains active and ongoing. Officials stated they will publish updates once they have more information to share with the public. Meanwhile, threat intelligence experts like Ian Gray from Flashpoint noted that the group later removed mentions of Florida from its dark web posts, suggesting negotiations may have taken place to stop the database leak.
Frequently asked questions
A criminal actor gained unauthorized access to a department system by acquiring credentials from a local Florida law enforcement employee who stored them improperly on an electronic device.
A cybercriminal group called ShinyHunters may have stolen the data, having previously claimed credit for hacking the FBI and posting about the Florida DMV breach on the dark web.
ShinyHunters posted a photo of the alleged driver license belonging to late financier and convicted sex offender Jeffrey Epstein, who was a former Florida resident.
State officials blocked unauthorized access, reset relevant user credentials, engaged cybersecurity professionals, and implemented additional safeguards to protect sensitive information.
The hack appears to be unrelated to a major breach of 153 million US driver licenses involving a company named IDscan.net that occurred last month.
Based on reporting by Ars Technica. Read the original article
