What this covers:
The FLHSMV data breach notification letters are going out. On October 16, 2026, the Florida Department of Highway Safety and Motor Vehicles said its September incident may have exposed driver license and motor vehicle data, document images and other personal information, and that it is mailing letters to current Florida driver license and ID card holders who may be affected.
The agency has not said how many people are affected. It has said what the letters offer, and that detail matters more than the mailing itself, because a real notice is the best cover a fake one can ask for.
Here is what the FLHSMV data breach letters contain, how the monitoring works, and how to tell a real notice from a fake if one lands in your mailbox or your inbox.
What the FLHSMV Data Breach Letters Say
According to the agency, someone accessed department records on September 4, 2026 using compromised credentials, meaning a real username and password in the wrong hands. The agency said it contained the activity and secured its systems.
It is investigating with the Florida Digital Service and the Florida Department of Law Enforcement. It also said it has no evidence so far that the information has been misused. That is a statement about what it knows today, not a guarantee about what happens later.
The monitoring offered in the FLHSMV data breach letters comes through Sontiq, a TransUnion company, and includes $1 million in identity theft insurance for one year. The agency’s release does not say how to enroll, which is normal: the enrollment code belongs in the letter, addressed to you, not on a public web page.
FLHSMV issues every license and ID card in Florida, including those held in Palm Beach and Broward counties, so the pool of people who could receive a letter is the whole state.
Moved away, or let your license lapse? The agency said it may not have current addresses for people who no longer hold a valid Florida license or ID card, or who once had a vehicle titled in Florida. If that describes you and no letter arrives, FLHSMV said to email customerinquiry@flhsmv.gov or visit flhsmv.gov/data-breach.
Why Exposed Document Images Matter
Most breach notices describe data fields. This one mentions images, and that changes the practical risk.
A copy of an ID document can help a fraudster pass an identity check when opening an account in someone else’s name. A Social Security number alone often fails modern verification, because lenders and platforms now ask for a photo of a license or a passport alongside it. A photo is exactly what an attacker holding document images already has.
FLHSMV has not said that has happened. It has also not said whether Social Security numbers were involved, what “other personal information” covers, or how many people are affected. Treat those as open questions, and take the steps below either way, because none of them cost anything and all of them work whether or not a letter arrives.
How to Spot a Fake FLHSMV Data Breach Letter
A real breach notice opens the door for fake ones. People expecting to hear from FLHSMV are more likely to trust a message that claims to be from FLHSMV, and no such scam has been reported in this case yet. It is the pattern to watch for, and the reason the FLHSMV data breach is worth explaining to staff before they see a lookalike.
The real notice comes by mail, and the monitoring costs you nothing. Five warning signs:
- A text or email that claims to be your breach notice, with a link to “enroll” or “verify”. The agency said it is mailing letters. Start there.
- Any fee or card number requested to activate the monitoring or the identity theft insurance.
- A caller claiming to be from FLHSMV, Sontiq or TransUnion who asks for your Social Security number, license number or a one-time code.
- Pressure to act today, or a threat that you will lose your license or registration if you do not respond.
- A web address that looks like flhsmv.gov but is not exactly that. Check the domain character by character before you type anything.
If a message about the FLHSMV data breach fails any of those five tests, do not click it, do not call the number in it, and do not reply. Report it, then delete it.
What to Do Now, Letter or Not
If you get a message about this breach: check it yourself by typing flhsmv.gov/data-breach into your browser, or by emailing customerinquiry@flhsmv.gov. Never use the contact details printed in an unsolicited message.
Protect yourself now:
- Freeze your credit with all three bureaus. A freeze is no-cost and stops new accounts from being opened in your name until you lift it. Equifax: 800-525-6285. Experian: 888-397-3742. TransUnion: 800-680-7289.
- Not ready to freeze? A fraud alert is the lighter option. It tells lenders to verify your identity before approving credit.
- Read your credit reports. They are available at no charge at AnnualCreditReport.com or 1-877-322-8228.
- Watch bank and card statements for charges you cannot place, and turn on two-factor authentication for email and financial accounts.
If you already responded to something suspicious, or you see signs of fraud: call your bank or card issuer using the number on the back of your card, report identity theft at identitytheft.gov, and file a report with your local police department. The Federal Trade Commission takes reports at reportfraud.ftc.gov, the FBI at ic3.gov, and the Florida Attorney General runs a fraud hotline at 866-966-7226.
What the FLHSMV Data Breach Means for Your Business
Two of these lessons land on a business, not just a driver.
1. A breach notice is an attack surface. Every notice campaign, yours or a vendor’s, trains your staff to expect an official-looking email about a security incident. The FLHSMV data breach letters go out by mail for exactly this reason. Write the rule down before the next one: staff never act on a breach message, they forward it to IT and check the vendor’s own domain. That single rule defeats most phishing attacks that target staff.
2. Owner and officer IDs are business credentials. If a principal’s license image is in a breach, the fraud risk does not stop at their personal credit. Business identity theft starts with the same documents: an ID, a utility bill, a filing number. Freezes and monitoring belong on the owner’s file, and the business should confirm its own records with the state and its bank.
We covered the September incident itself in our September report on the Florida DMV data breach, including what compromised credentials usually mean in practice. If your team has no written rule for handling a breach notice, or no idea which vendor holds copies of employee IDs, that gap is worth closing in a cybersecurity services review.
FLHSMV Data Breach FAQ
Did FLHSMV say how many people are affected? No. As of October 16, 2026 the agency had not published a number of affected license and ID card holders, and the investigation is ongoing.
How do I enroll in the monitoring offered in the FLHSMV data breach letters? The agency’s release does not say. Enrollment details will be in the letter itself, which is why any message that offers an enrollment link before your letter arrives should be treated as suspicious.
What does the monitoring cover? Credit and identity monitoring for one year through Sontiq, a TransUnion company, including $1 million in identity theft insurance.
Is it a scam if I get an email or text instead of a letter? Yes, treat it as one. FLHSMV said it is mailing letters. Verify independently at flhsmv.gov/data-breach rather than using anything in the message.
What was actually exposed? Driver license and motor vehicle data, document images and other personal information, according to the agency. It has not said whether Social Security numbers were involved.
Should my business do anything differently? Yes: brief staff that breach notices arrive by mail, not by link, and confirm which vendors hold copies of employee and owner ID documents.
Sources: Boca Post’s October 16, 2026 report on the FLHSMV breach letters; the agency’s own notice at flhsmv.gov/data-breach; the Federal Trade Commission’s data breach guidance at identitytheft.gov/databreach; and AnnualCreditReport.com. Enrollment details are not public; they arrive with the letter.
Not sure how your team would handle a breach notice? Contact Nextek IT to book a call and we will review how notices reach your staff and who verifies them.