One Plant City police employee kept a login on a personal device. According to the Florida Department of Highway Safety and Motor Vehicles (FLHSMV), that was enough for “an international cybercriminal organization” to reach Florida driver records. The department says it learned of the breach on Sept. 4, 2026, and said so in a Sept. 11 statement.
The department’s breach page lists what may have been accessed: driver license data, motor vehicle information, document images and other personal information. It says it has no evidence any of it has been misused, that the breach was quickly mitigated, and that there is no sign of ongoing access. Drivers whose information was identified as potentially affected, and for whom the department has a valid mailing address, will get a letter with instructions for one year of free credit monitoring through Sontiq, a TransUnion company.
What the department has not published is the part drivers most want: how many people are affected, which state system the login opened, what dates the intruder had access, and whether the account was protected by anything beyond a password. That last question decides whether this was one employee’s mistake or a gap in how the state lets outside agencies in.
Why a city police login reaches a state database
Federal law generally bars state motor vehicle agencies from handing out personal information from driver records. The Driver’s Privacy Protection Act, 18 U.S.C. 2721, carves out use by any government agency, including a law enforcement agency, in carrying out its functions. That exception is why a municipal police department has people with logins to a state records system at all. FLHSMV describes its Driver And Vehicle Information Database, known as DAVID, as a tool built for law enforcement and criminal justice users, though the department has not said DAVID was the system involved here.
The consequence is structural. Every agency with a legitimate need adds accounts, and every account is a door the state does not physically control. The state can harden its own servers and still lose records through a password sitting on a phone or laptop it has never seen. A federal class action against Flock Safety, which The Auto Wire covered in September, centers on the same question of how police logins are protected.
Florida’s 30-day notification clock
Section 501.171 of the Florida Statutes applies its notice rules to government agencies. It requires notice to affected individuals as expeditiously as practicable and no later than 30 days after a breach is determined or there is reason to believe one occurred. The deadline can slide if a law enforcement agency makes a written request to delay notice because it would interfere with a criminal investigation. Without that, a Sept. 4 start puts the 30-day mark at Oct. 4, or Oct. 19 with the 15-day good-cause extension the statute allows. Those dates are The Auto Wire’s arithmetic from the department’s Sept. 4 date, not a finding by the department or a court.
FLHSMV’s public pages, as of Oct. 27, say affected drivers will be notified by mail but do not say when letters go out, or whether a law enforcement delay is in play. The same statute makes information the Department of Legal Affairs receives about a breach confidential while an investigation is active, which may explain the thin public record. The department calls this an ongoing criminal investigation.
The statute also caps civil penalties for late notice at $500,000 per breach, not per person affected, and says it creates no private cause of action. A driver whose data was taken cannot sue under Section 501.171, so the state’s own reporting is the main accountability tool. The Department of Legal Affairs must give the Legislature an annual report by Feb. 1 on breaches reported by governmental entities in the prior calendar year, and it must name any entity that violated the statute’s requirements.
What stolen license data does at a dealership or rental counter
A name paired with a driver license number is itself “personal information” under Section 501.171. The department also lists document images among the data that may have been accessed, and has not said what those images show. A scan of a license is what a dealer, lender or rental counter looks at when it decides a person is who they say they are. We reported in September that a license-scanning vendor used by Hertz and dealers was linked to a 153-million-record leak, so license data tied to the car business is already circulating.
The department recommends monitoring accounts, reviewing credit reports, and considering a fraud alert or credit freeze. A freeze is the most relevant of those for car shoppers, because a fraudulent auto loan needs a lender to pull the victim’s credit report, and a freeze blocks that. The catch is timing: lift it at the bureau you expect the dealer to use before you apply for financing, then put it back. Drivers who want to know whether they were affected can email the department at CustomerInquiry@flhsmv.gov.
What to watch next
Watch for the headcount, which FLHSMV hasn’t given. And for whether the stolen login lacked a second authentication factor, since that answer decides how much of this is one employee’s lapse. The Feb. 1 report from the Department of Legal Affairs will show how the state scored itself on the notice rules.
If one saved password can open a statewide driver database, who should carry the blame: the employee who stored it, or the state that issued it?