A data breach at the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) may have exposed driver license records, motor vehicle data and document images belonging to current and former Florida residents.

FLHSMV said on its breach notification page that it discovered the breach on Sept. 4. An international cybercriminal organization gained access to department systems using credentials stolen from an employee of a local Florida law enforcement agency who had improperly stored them on an electronic device, the department said.

The department has not disclosed how many individual records were accessed, as the Sun Sentinel reported. FLHSMV said the breach has been contained and there is no evidence of ongoing unauthorized access.

"At this time, FLHSMV has no evidence indicating that information has been misused," the department stated.

Anyone who holds or previously held a Florida driver license, identification card or vehicle title could potentially be affected. Residents of Aventura, Sunny Isles Beach and Golden Beach could potentially be affected, although the department's public notice does not identify affected individuals by city.

FLHSMV, led by Executive Director Dave Kerner, announced Oct. 16 that it would send letters that week to current license and ID card holders who may have been affected. The agency offered one year of free identity and credit monitoring through Sontiq, Inc., a TransUnion company, along with $1 million in identity theft insurance.

Former Florida residents and people who no longer hold a valid license or ID card may not receive a letter. Those individuals can email FLHSMV at [email protected] to find out whether their data was compromised.

The investigation is being conducted with the Florida Digital Service and the Florida Department of Law Enforcement. FLHSMV identified the compromised credentials as belonging to a Plant City Police Department employee. The department has not identified the cybercriminal group responsible.

Some residents have complained that they received notification only in mid-October, more than a month after the Sept. 4 breach, Ars Technica reported.

FLHSMV recommends that potentially affected residents take these steps:

  • Monitor financial and online accounts for suspicious activity.
  • Review credit reports regularly.
  • Consider placing a fraud alert or credit freeze with Equifax (800-525-6285), Experian (888-397-3742) or TransUnion (800-680-7289).

Free credit reports are available at AnnualCreditReport.com or by calling 877-322-8228.