AssuranceAmerica, a US auto insurer, disclosed a massive data breach affecting millions of customers. The company said a March cyberattack exposed the personal data of about 7 million people.
The incident came to light on March 17, 2026, when suspicious activity was detected. The company's investigation determined that an employee had been targeted the day before, and an unauthorized third party had infiltrated its IT infrastructure and copied data files.
Affected individuals and stolen data
In a notice filed with the Indiana Attorney General's office, the number of individuals affected by the breach was recorded as 6,998,886. The California Attorney General's office also announced that AssuranceAmerica began sending notifications to those affected after completing its file review on June 15, 2026.
The stolen files contained names, contact information, auto insurance policy and account details, driver and vehicle information, claims data, and driver's license numbers. According to the California notice, some files may have also included tax identification numbers and Social Security numbers.
Company response and measures taken
AssuranceAmerica said it disabled affected servers, worked with external forensic experts, reset passwords, and deployed enhanced monitoring systems following the incident. The company also provided cybersecurity training to its employees and notified law enforcement.
Affected customers will be offered 12 months of free credit monitoring. However, security experts warn that the exposure of driver's license numbers significantly increases the risk of identity theft and fraud.
Experts warn of fraud risks
Experts emphasize that driver's license and insurance information enables scammers to craft more convincing scenarios. They highlight the risk that a fraudster with such data could call individuals, using policy or claims details as a pretext to request additional information for 'verification'.
Authorities advise those who receive a breach notification to take steps such as freezing their credit, placing fraud alerts, and regularly monitoring their insurance accounts.
