The breach came through a single Plant City Police Department user's credentials stored on a personal device

Assessment

This is the state's own finding, stated in its 11 September release: "a criminal actor was able to take advantage of a single Plant City Police Department user's credentials that were improperly housed on the employee's personal electronic device." It is verified as the entry vector FLHSMV identified. It does not establish that the credential was the only account used, how the device was compromised, or whether the user was sworn or civilian; Plant City PD has not commented, and FLHSMV has not addressed the attacker's claim of subsequent account compromises.