Insurance breach exposes 7M driver's licenses

AssuranceAmerica, an auto insurance provider that works through a network of independent agents, has disclosed a data breach affecting nearly 7 million people. The exposed information includes driver's license numbers and other personal details tied to auto insurance customers.

The company said it detected suspicious activity on March 17, 2026, after malicious activity targeted one of its employees one day earlier. Investigators later found that an unauthorized third party accessed parts of AssuranceAmerica's IT environment and copied certain data files.

According to an Indiana Attorney General breach listing, the incident affected 6,998,886 people. A California Attorney General notice also says AssuranceAmerica began notifying affected individuals after completing its file review on June 15, 2026.

AssuranceAmerica sells auto, renters and commercial auto insurance through independent agents. So, even if the company name does not sound familiar, your information could still be involved if your policy, quote, claim or driver details passed through its systems.

ADT DATA BREACH EXPOSES CUSTOMER INFORMATION

Free live CyberGuy class: Sick of Spam? Join us July 22

Join us Wednesday, July 22, at 1 p.m. ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages. Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk. No technical experience is needed. You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

AssuranceAmerica said the breach started with malicious activity that targeted one employee. The company did not explain exactly how the employee was targeted. However, it said it later disabled compromised credentials and unauthorized sessions.

That detail should get your attention. Many breaches start with one stolen login, one convincing message or one infected device. Once attackers get inside, they can move quickly and look for files worth stealing.

In this case, AssuranceAmerica said an unauthorized third party copied certain data files from its IT environment. The company then reviewed those files to identify affected individuals.

AssuranceAmerica said the stolen files contained names plus one or more other types of personal information. That information may include contact details, auto insurance policy or account information, driver or vehicle information, claims-related information and driver's license numbers. The California notice also says some files may have included Tax ID information and/or Social Security numbers.

That mix can create real risk. A scammer with your name, license number and insurance details may sound much more convincing. They could pretend to be from your insurer, a repair shop, a claims department or a state agency. This follows other identity-document breaches, including the Texas data breach that hit 3 million license customers. Once driver's license numbers leak, the risk can last much longer than a stolen credit card number.

AssuranceAmerica said it took affected server devices offline and hired external forensic specialists to investigate. The company also said it reset passwords, deployed enhanced monitoring and threat detection tools and gave employees more cybersecurity instruction. It also notified law enforcement.

AssuranceAmerica is offering 12 months of complimentary credit monitoring for affected individuals. That can help spot some suspicious activity. However, you still need to watch your insurance account, financial accounts and mail.

A driver's license number can help an imposter build a more believable scam. Insurance information can make that scam feel personal.

For example, a caller may mention your policy, your vehicle or a claim. Then they may ask you to "verify" more information. That is where the damage can grow.

Also, stolen breach data can be matched with public records and data broker profiles. That can give criminals a fuller picture of your life. We have seen the same pattern in scams tied to travel accounts, phone accounts and other breaches, including the Booking.com breach that exposed traveler data to scams.

BEFORE YOU CONNECT ANOTHER SMART TV, TABLET OR PHONE, LOCK IT DOWN

If you receive a notice or think your information may be involved, take these steps now to make the stolen data harder to use.

If you receive a notice from AssuranceAmerica, read it carefully. Check what information the company says may have been exposed in your case. Do not assume every affected person had the same data stolen. Some people may have had driver's license numbers exposed. Others may also have had Tax ID information or Social Security numbers involved.

AssuranceAmerica says it is offering 12 months of complimentary credit monitoring. Use the instructions in the official notice. Be careful with emails or texts that claim to offer enrollment links. Scammers often copy real breach language to trick you.

A credit freeze makes it harder for someone to open a new account in your name. You need to place a freeze separately with Equifax, Experian and TransUnion. It is free, and you can lift it when you need to apply for credit.

A fraud alert tells lenders to take extra steps before opening credit in your name. You can place a fraud alert with one credit bureau, and that bureau should notify the others. This adds another layer of protection if your personal information was exposed.

Log in to your insurance account and check for changes you do not recognize. Look for unfamiliar claims, new contact details or strange policy updates. If something looks wrong, call the company using a number from your policy documents.

Credential theft often starts with malware, a bad link or a fake download. Strong antivirus software can help block malicious files and phishing links before they cause damage. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

CARNIVAL BREACH MAY PUT YOUR TRAVEL DATA AT RISK

Breached data becomes more useful when scammers can match it with your address, relatives, phone number or public records. A data removal service can help reduce what data brokers display about you. That will not undo a breach, but it can make you a harder target. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

If someone calls about your policy, claim or payment, slow down. Do not share verification codes. Do not confirm sensitive details during an unexpected call. Instead, hang up and call the company back through an official number.

If your driver's license number was exposed, review your state DMV's fraud guidance. Some states may offer replacement options or identity theft guidance. The rules vary, so check directly with your state agency.

Create strong, unique passwords for your insurance account, email and financial apps. A password manager can also help you spot fake login pages. If it will not autofill, you may be on a scam site. Check out the best expert-reviewed password managers of 2026 at CyberGuy.com.

Turn on two-factor authentication (2FA) for your insurance account, email and financial accounts when available. Use an authenticator app when you can. Text codes are better than nothing, but scammers often target them.

The AssuranceAmerica data breach is a reminder that your driver's license number has become a high-value target. You may not be able to control how every company stores your information. However, you can make stolen data harder to use. Start with your credit. Then check your insurance account and watch for imposters who know just enough to sound convincing. Also, clean up the personal data already floating around online. The bigger issue is trust. Companies ask for sensitive information because they need it to do business. When that information leaks, you are the one left checking statements, freezing credit and worrying about what comes next.

What should a company owe you when it loses the ID number you use to prove who you are? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.