ShinyHunters Hack Florida DMV, Expose Millions of Records
In mid-2023, ShinyHunters hacked Florida DMV, exposing millions of driver and vehicle records.
Why it matters: Legal teams at corporations and law firms must reassess breach notifications and compliance under Florida’s Information Protection Act amid this large-scale exposure. Understanding breach scope is vital to managing regulatory risks and obligations.
- ShinyHunters accessed Florida DMV data in mid-2023, compromising millions of personal records including driver licenses and vehicle registrations.
- Known since at least 2020, ShinyHunters has executed major breaches, like a 3.65 TB leak of Canvas University data affecting 275 million users.
- Florida’s Information Protection Act requires prompt notification to affected individuals and the Attorney General after breaches involving personal data.
- Corporate legal counsel should review incident response plans and privacy policies to address potential enforcement actions and reputational risks.
ShinyHunters, a hacking group active since 2020, breached the Florida Department of Motor Vehicles (DMV) in mid-2023, exposing millions of personal records including driver license and vehicle registration details. This breach represents a significant risk to Floridian residents and organizations relying on secure government data.
The group’s history of major cyberattacks is well documented. In May 2023, ShinyHunters leaked 3.65 terabytes of data from Canvas University, impacting 275 million users associated with 8,809 institutions, as reported by BleepingComputer and corroborated by ZDNet. This shows the group’s consistent capability to exploit large-scale data systems.
While the exact number of compromised Florida DMV records is not fully disclosed, references from cybersecurity firms indicate the breach affects millions, given Florida’s population and DMV records scope. The leaked data includes sensitive personal and vehicle information, raising significant privacy and security implications.
Legally, the breach triggers obligations under Florida’s Information Protection Act (FIPA). This law requires entities holding personal data to notify both affected individuals and the Florida Attorney General within 30 days of discovering a breach. Failure to comply can result in penalties and enforcement actions.
For corporate legal and compliance teams, the breach underscores the need to reassess breach response procedures, data security measures, and notification protocols. Ensuring regulatory compliance and preparing for potential investigations is critical to limit legal and reputational damage.
Stakeholders should also monitor developments closely, as ongoing investigations may yield new details that influence compliance strategies and risk management. Organizations must enhance data protection practices to mitigate risks from sophisticated threat actors like ShinyHunters.
By the numbers:
- 3.65 terabytes — data leaked by ShinyHunters from Canvas University in May 2023
- 275 million — users impacted by Canvas University leak tied to ShinyHunters
- 30 days — maximum time to notify under Florida’s Information Protection Act after breach discovery
Yes, but: The full extent and specific contents of the Florida DMV breach remain under ongoing investigation, limiting complete risk assessment at this time.
What's next: Florida DMV and cybersecurity agencies are expected to release further information and guidance as investigations proceed. Legal teams should watch for official breach notifications and regulatory updates.