Ransomware group ShinyHunters alleges on its online platform that it has compromised the Florida Department of Motor Vehicles’ Driver and Vehicle Information Database (DAVID) and stole the DMV records of over 200,000 individuals. The threat actor posted a screenshot of Jeffrey Epstein’s DMV record as proof.
The DAVID records of drivers include their name, address, Social Security number, birthdate, driver’s license ID, and other information. ShinyHunters told BleepingComputer they “breached DAVID through a password-reset flaw that let them compromise multiple accounts in the system. These accounts allegedly belonged to DMV employees and an FBI agent.” ShinyHunters no longer has access to the database and the “password-reset flaw used to compromise accounts is being patched.”
It is believed that ShinyHunters is “targeting other states’ DMV platforms using social engineering attacks.”This is a common strategy for ransomware groups—to concentrate on a particular industry and when they find a way to get into one, they use the same technique to attack others in the same industry.
State DMVs hold vast amounts of valuable personal information. State agencies should train their employees about social engineering attacks, how to identify them, and put robust security measures in place to protect this valuable information of its residents.