One saved password. One personal phone. One statewide breach.

In September 2026, the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that its DAVID driver and vehicle database had been breached. The agency said it learned of the breach on September 4 and that the attacker took advantage of credentials belonging to a single Plant City Police Department user. Those credentials, according to FLHSMV, had been improperly stored on the employee's personal electronic device.

The ShinyHunters extortion group later claimed responsibility and published files it said came from the database. FLHSMV is working with the Florida Digital Service and the Florida Department of Law Enforcement on the investigation.

Plant City is a short drive from our office in Wesley Chapel. This wasn't a distant headline. It was a local lesson in how one small habit can open a very big door.

This isn't really a government problem

It's easy to read a story like this and think, "That's a state agency issue." But the root cause is something we see in small businesses all over Tampa Bay:

•         An office manager saves the bank login in the browser on her personal laptop.

•         An agent checks business email on a phone with no passcode and no updates in a year.

•         Someone texts the shared Wi-Fi password and the admin login to a new hire.

•         Passwords live in a notes app that syncs to a personal cloud account.

None of these feel dangerous in the moment. Each one creates a copy of the keys to your business that you don't control.

How credentials on personal devices get stolen

Personal devices are a soft target. They're more likely to have malware from a sketchy app or browser extension. They're shared with family. They're lost or stolen. And they rarely have the monitoring your business systems do.

Today's "infostealer" malware is built to scoop up saved passwords and login sessions from browsers and send them to criminals, who sell them in bulk. One infected personal laptop can hand over every work login saved on it.

What to put in place this month

You don't have to ban personal phones. You do need a few clear rules:

1.       Business passwords live in a business password manager. Not in personal browsers, notes apps, or texts. When someone leaves, you revoke access in one place.

2.       Set minimum standards for any device that touches company data. A passcode, automatic updates, and encryption at a minimum.

3.       Use mobile device management for email and files. This lets you separate business data and wipe it remotely without touching personal photos.

4.       Turn on phishing resistant login methods. Passkeys or strong MFA make a stolen password far less useful.

5.       Watch for unusual logins. Security monitoring can flag a login from an unexpected location before it turns into a breach.

For Florida insurance agencies

Rule 69O-128.032 requires licensees to protect customer information and control access to it. Agents using personal phones to reach agency management systems or carrier portals are a real exposure. Your written information security program should spell out what's allowed and how it's enforced.

The takeaway

The Florida DMV breach didn't start with a sophisticated hack. It started with credentials in the wrong place. That's good news, because it's one of the most fixable problems in cybersecurity.

Main Event Managed Services helps Wesley Chapel and Tampa Bay businesses lock down personal device access without making life harder for their teams. Learn more at maineventmsp.com.

Sources: FLHSMV statement, Sept 11, 2026 · TechCrunch, Sept 16, 2026