Friday Security Briefing: Weekend Attack Alert — ShinyHunters Hits the Florida DMV

By Katrina — Wealth Horizons Academy Security Advisor  |  Friday, September 18, 2026

Before you head into the weekend, pull up a chair. This week was a rough one in cybersecurity — and if you run a business of any size, what happened in the last seven days is directly relevant to you. Three major incidents broke this week: a fresh government data breach by one of the most prolific hacking gangs on the planet, an identity document database exposing 150 million Americans' driver's licenses, and ongoing supply-chain attacks that are silently moving through corporate software. Let's talk about what it means for your business.

🚨 This Week's Threat: ShinyHunters Just Breached the Florida DMV

In 2026, the ShinyHunters hacking gang has become one of the most destructive criminal groups in operation — and on September 16, just two days ago, they added the Florida Department of Motor Vehicles to their list of victims. According to BitSight Pulse, the breach involved 52 gigabytes of compressed government data. What that data contains — and who will be targeted with it next — is still being determined.

This isn't ShinyHunters' first rodeo this year. The same group breached Instructure's Canvas platform and stole private data on 30 million students, broke into Charter Communications and took 40 million customer records, and compromised Carnival Cruise Lines. Their method is deceptively simple: voice phishing and social engineering. They call your staff, pretend to be IT, and walk right in.

Meanwhile, the IDScan breach adds another layer of danger. An identity document checking company — the kind used at check-in systems, age-verification portals, and secure access points — was breached over the course of a year. Hackers built a searchable dark web database containing the license photos of 150 million drivers in the U.S. and Canada. If your business uses any identity verification service, you need to ask your provider direct questions about their security posture. Today.

📊 The Numbers You Need to Know This Week

Numbers tell the story better than headlines. Here's the hard data from this week and from 2026's breach landscape so far — context your team needs before Monday.

What these numbers share is a pattern: large, trusted institutions are being breached through human-layer attacks — not exotic zero-day exploits. ShinyHunters doesn't hack your firewall. They call your receptionist. The Klue breach — which affected cybersecurity giants including LastPass, Jamf, and HackerOne — happened because a credential issued in 2022 was never decommissioned. Four years of exposure. One phone call to exploit it.

Small and mid-sized businesses often assume they're below the radar. The data disagrees. Criminal groups use automated tools to scan thousands of businesses simultaneously. The question isn't whether your company is big enough to be targeted. The question is whether you're easy enough to be worth the attempt.

✅ What To Do Before Monday

Here's your no-nonsense action list. Do at least one of these today. Do all five by Monday morning and you'll be meaningfully more protected than 80% of businesses your size.

• 1 Brief your team on weekend phishing. Send a quick message — even a text — reminding staff not to click unexpected links, respond to urgent financial requests, or share passwords over the phone. ShinyHunters uses voice phishing. Awareness is your first firewall.
• 2 Enable multi-factor authentication (MFA) on all business accounts. Email, accounting software, cloud storage, CRM — everything. This single step blocks over 99% of automated credential-stuffing attacks. If you already have MFA, verify it hasn't been quietly disabled.
• 3 Audit any credential older than 12 months. The Klue breach happened because a 2022 credential was never removed. Pull your account list today. Deactivate anything that doesn't need to be active. This takes 15 minutes and can prevent a catastrophic breach.
• 4 Check if your identity verification provider has issued a security statement. Given the IDScan breach, any service that scans or stores your customers' ID documents may be at elevated risk. Ask directly. Demand transparency.
• 5 Your one immediate action: Right now, log into your primary business email account and check your active login sessions. If you see devices or locations you don't recognize, revoke access immediately and change your password. Takes 2 minutes. Do it before you close this tab.