Insurance provider AssuranceAmerica has confirmed a data breach affecting the personal information and driver’s license numbers of up to 6.9 million people.

AssuranceAmerica provides car and rental insurance to customers across 14 US states through a network of over 9,500 independent agents.

TechCrunch reports:
“AssuranceAmerica said it discovered hackers in its computer systems on March 17. The company concluded its investigation on June 15, finding that the hackers had stolen customers’ names, contact information, and driver’s license numbers.“

The breach notice letter also mentions information about customers’ auto insurance policies and accounts, their drivers and vehicles, and details about customer claims. 

AssuranceAmerica has not yet released a public statement about the data breach. However, public breach notices and independent reporting indicate that the incident began with a targeted phishing attack against a single employee. An unauthorized third party accessed parts of the insurer’s IT systems and copied files containing customer policy information and driver’s license numbers. So far, no law‑enforcement or vendor report has publicly linked this activity to a specific threat group, ransomware operation, or nation‑state actor.

No public source has reported a ransom demand, negotiations, or payment, and AssuranceAmerica’s public filings are quiet about any contact with the attackers.

Protecting yourself after a data breach

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

• Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened and follow any specific advice they offer.
• Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose and store one for you.
• Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop, or phone as your second factor. Some forms of 2FA can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
• Watch out for impersonation scams. Criminals may contact you pretending to be the company. Check the company’s website to see how it is contacting affected customers, and verify anyone who contacts you using a different communication channel.
• Take your time. Phishing attacks often impersonate people or brands you know, and create a false sense of urgency with messages about missed deliveries, suspended accounts, or security alerts.
• Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
• Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online and helps you recover if your identity is stolen.

Check your personal data exposure

You can check whether any of your personal information has been exposed using our Digital Footprint portal. Enter the email address you use most often and we’ll generate a free Digital Footprint report.

AssuranceAmerica says hackers accessed the driver's license data of 6.9 million customers, exposing personal information and raising concerns about identity theft.

The post AssuranceAmerica Data Breach: 6.9M Driver’s License Numbers Exposed appeared first on TechRepublic.

AssuranceAmerica confirmed a breach exposing nearly 7 million driver’s licenses after hackers compromised an employee account and stole customer data.

U.S. auto insurer AssuranceAmerica has confirmed a data breach affecting nearly 7 million people, making it the largest known theft of Americans’ driver’s license information in 2026.

“In a data breach notice sent to customers and seen by TechCrunch, AssuranceAmerica said it discovered hackers in its computer systems on March 17.” TechCrunch reported. “The company concluded its investigation on June 15, finding that the hackers had stolen customers’ names, contact information, and driver’s license numbers.” 

The company operates across more than a dozen states through a network of over 9,500 independent agents, handling large volumes of customer identity and vehicle data. Notification letters go out July 10.

The attack vector was a compromised employee credential; how that credential was stolen, whether through phishing, infostealer malware, or a third-party compromise, hasn’t been disclosed.

“On March 17, 2026, the Company detected suspicious activity involving certain Company systems that appears to have resulted from malicious activity on March 16, 2026 that targeted one of theCompany’s employees. The Company promptly began an investigation and engaged external computer forensic specialists to help determine what occurred and what data may have been impacted.” reads the data breach notification.

AssuranceAmerica detected the breach on March 17 but didn’t finish reviewing the affected files until June 15, three months later. The company disabled the compromised credentials, cut off unauthorized sessions, isolated affected systems, and notified law enforcement.

The data stolen covers a wide range of customer information, including names, contact details, and driver’s license numbers. The company hasn’t specified what other personal data types were taken, which is a gap that tends to frustrate regulators and affected customers alike.

“During the investigation, the Company determined that an unauthorized third party accessed certain portions of the Company’s informational technology (IT) environment and copied certain data files.” continues the notification.”The Company subsequently conducted a review of the affected files to identify individuals whose personal information may have been contained within those files. Because of the nature of the files involved and the scope of the required review, this file evaluation process was only recentlycompleted (on June 15, 2026), and we are now providing this notice.”

In response to the incident, the company disabled compromised credentials, removed unauthorized sessions, isolated affected systems, notified law enforcement, and strengthened security controls with password resets, monitoring, and employee training.

“The Company has taken, and continues to take, steps to prevent a similar incident from happening in the future. After detecting the activity, the Company disabled compromised credentials, terminated unauthorized sessions, isolated affected systems as appropriate, and notified law enforcement,” continues the notification. “The Company also implemented additional measures designed to enhance the security of its IT systems and data, including resetting passwords, deploying enhanced monitoring and threat detection tools, and providing additional instruction to personnel regarding cybersecurity threats.”

In June, the Texas Parks and Wildlife Department (TPWD) disclosed a data breach affecting around 3 million individuals after a third-party vendor used for hunting and fishing license sales was compromised.

The Texas Parks and Wildlife Department (TPWD) is the state agency responsible for managing and protecting Texas’s natural and recreational resources.

Hackers may have accessed email addresses, physical addresses, phone numbers, driver’s license details, and passport numbers.

The incident was identified through Texas Cyber Command and highlights risks tied to third-party service providers.

Driver’s license numbers are useful for fraud and impersonation in ways that, say, a leaked email address isn’t, they tie directly to identity verification systems used by financial institutions, government services, and increasingly by websites and apps demanding age verification. The more those systems expand, the more valuable license data becomes to attackers, and the bigger the incentive to go after the insurers, governments, and services that hold it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)