The breach was carried out through a stolen account tied to law enforcement, which gave the attackers access to the driver records stored in the DAVID system. FLHSMV has acknowledged the incident and confirmed that the unauthorized access occurred via these compromised credentials.

Details on the full scope of the breach, including how many records were affected or when the access took place, have not been disclosed in the available reporting.

Key facts:

• Affected system: DAVID driver database
• Affected organization: Florida Department of Highway Safety and Motor Vehicles (FLHSMV)
• Attack method: access via stolen credentials belonging to a police department employee

This incident highlights the ongoing risk posed by credential theft, particularly when accounts with access to sensitive government systems are targeted.

Source: BleepingComputer

Does your organization enforce phishing-resistant MFA for accounts with access to sensitive databases like this one?