They Came In Through a Police Login (09/11/2026)

The Florida breach is worth more attention than its size suggests, because nothing was defeated to make it happen. Somebody used a working police account, and every control the state built around that database assumed the person holding those credentials was the person the credentials were issued to.

Top 5 Critical Privacy Alerts

1. Florida’s Driver Database Was Reached With a Police Login

The Florida Department of Highway Safety and Motor Vehicles confirmed a breach of its DAVID driver database, saying attackers used credentials belonging to an employee of a police department. Systems like this hold addresses, photographs, and license records for everybody in the state, and access is extended to thousands of law enforcement users on the assumption that each one is accountable through their own department. That model has one person’s stolen password between an attacker and the whole population. BleepingComputer has the confirmation.

Operator Note: Any dataset you extend to partner organizations inherits their weakest identity practices, so ask what MFA and session policy apply on their side before the next access agreement renews.

2. DHS Opens a $440 Million Biometric Capture Procurement

The Department of Homeland Security launched a government-wide solicitation with a ceiling of $440 million to standardize how federal agencies capture fingerprints, faces, irises, and palmprints, through a multiple-award contract that will shape collection practice for years. A procurement sets defaults quietly and durably, since whichever capture standard wins becomes the shape of every downstream database built on top of it. The decisions that matter most for a biometric program tend to be made at this stage, well before the legislation that follows catches up to them. Biometric Update has the solicitation.

3. The Industry Defends Plate Readers as Bans Gain Support

The Security Industry Association publicly defended regulated automated license plate reader use while calling for tighter privacy safeguards, as backlash against Flock Safety drives bipartisan calls for restrictions and outright prohibitions. A trade body arguing for its own regulation is a signal that the industry expects the alternative to be worse, and the argument it is making rests on restricting use while leaving collection where it is. Whether that distinction survives contact with the current mood is the open question. Biometric Update has the position.

4. Australia Doubles Penalties and Expands eSafety Powers

Australia’s parliament passed the Online Safety Amendment for the social media minimum age, granting the eSafety Commissioner broader investigatory and examination powers and doubling the available penalties, with assent in September. Australia keeps arriving first on platform accountability, which makes its enforcement record the best available preview of what similar rules look like in practice elsewhere. The investigatory powers matter more than the penalty figures, because they determine what a regulator can compel before anybody is fined. Biometric Update has the bill.

5. Amazon’s New Ring Encryption Does Less Than the Name Suggests

The EFF examined Amazon’s Throw Away the Key encryption feature for Ring cameras and concluded it reduces how much video the company holds without delivering meaningful privacy, since the architecture still leaves material reachable. A feature named for what it discards invites customers to believe a stronger claim than the engineering supports. Anybody evaluating a camera product on a privacy promise should read the technical description rather than the feature name. EFF has the analysis.

Operator Note: Apply the same reading to your own vendor claims, because “encrypted” describes a state of data at one point in a pipeline and says nothing about the other points.

Additional Privacy Alerts

Enforcement

• The CNIL fined EXTIA 300,000 euros: The French regulator penalized the consulting firm for failing to respect individuals’ rights, which is the category of violation that comes from ignoring requests rather than from losing data. EDPB

Identity Verification

• Transcript requests now come with a biometric selfie: Instructure added Veriff identity checks to Parchment, so students ordering an official transcript may be asked for a government document and a live face capture. Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.