AssuranceAmerica breach exposes 6.9 million driver's licenses

Key Takeaways

• Hackers stole driver's license numbers, names, contact info, and insurance policy details from 6.9 million AssuranceAmerica customers
• The breach stemmed from compromised employee credentials, discovered March 17 with investigation concluding June 15
• Driver's license numbers cannot be easily changed like credit cards, creating long-term identity fraud risks for victims

AssuranceAmerica, a U.S. car insurance provider, has confirmed that hackers stole the personal information and driver's license numbers of 6.9 million people. This makes it the largest known breach of Americans' driver's license data in 2026. The company discovered the intrusion on March 17 and finished its investigation on June 15, according to breach notices filed with state attorneys general and first reported by TechCrunch.

The stolen data includes names, contact information, driver's license numbers, auto insurance policy details, vehicle information, and claims histories. AssuranceAmerica said hackers "targeted one of the Company's employees" and that it "disabled compromised credentials" afterward. The company did not explain how attackers obtained those credentials, though similar incidents have involved password-stealing malware or compromised software.

Why driver's license theft is worse than credit card fraud

Credit card numbers can be canceled and reissued within days. Driver's license numbers cannot. They are tied to state DMV systems and rarely change over a person's lifetime. A criminal with your license number can open fraudulent accounts, file fake tax returns, or impersonate you to law enforcement. Victims may discover fraud years later when applying for a mortgage or getting pulled over.

This creates a different risk profile than typical breaches. The 6.9 million affected individuals face potential identity fraud for decades, not months. AssuranceAmerica operates across more than a dozen states, so the geographic spread is substantial. Notification letters were scheduled for July 10.

The company stayed quiet on key questions

TechCrunch contacted CEO Joe Skruck and founder Guy Millner asking whether AssuranceAmerica had any contact with the hackers or paid a ransom. Neither responded. The breach notice also omitted specifics about what other personal information was taken beyond the categories listed.

AssuranceAmerica, founded in 1998 and based in Atlanta, specializes in non-standard auto insurance. This market serves higher-risk drivers who struggle to obtain coverage elsewhere. These customers must submit extensive documentation, which means the company holds unusually detailed personal records. That made it an attractive target.

A pattern of identity document breaches

This incident fits a troubling 2026 trend. In June, the Texas state government disclosed that hackers stole at least 3 million driver's licenses and passport numbers from its parks and wildlife division. TechCrunch has reported on security failures at a hotel check-in system, a money transfer app, a prison payphone provider, and a U.K. visa service, all of which spilled government-issued identity documents.

The timing is not coincidental. Websites and apps increasingly demand identity documents for age verification, driven by new laws worldwide. More companies hold more copies of sensitive IDs than ever before. When any of those companies gets breached, the damage radiates outward.

What affected customers should do

AssuranceAmerica is offering credit monitoring, but that only catches fraud after it happens. Affected individuals should consider these additional steps:

• Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion
• Monitor your state DMV account for unauthorized license duplicates or address changes
• File an IRS Identity Protection PIN request to prevent fraudulent tax filings
• Watch for phishing emails claiming to offer breach-related compensation

The breach notification, shared by the Maine attorney general's office, lists exactly 6.99 million affected people. Maine's breach portal itself is currently offline after a fraudulent disclosure was posted there last month.

The regulatory fallout is just beginning

Breaches this size attract attention from state attorneys general, who have increasingly pursued enforcement actions against companies with inadequate security. Indiana and Maine have already listed the incident. Expect investigations from other affected states. Class action lawsuits are also likely, given the scale and sensitivity of the exposed data.

AssuranceAmerica's silence on ransom payments leaves open the question of whether this was a ransomware attack with data exfiltration. If so, the stolen records may already be circulating on criminal forums. The company has not indicated whether it has evidence of data being sold or misused.

Frequently Asked Questions

How do I know if I was affected by the AssuranceAmerica breach?

AssuranceAmerica is sending notification letters to affected individuals starting July 10, 2026. If you have been a customer or applied for insurance with the company, watch for this letter and monitor your credit reports.

Can I change my driver's license number after a breach?

Some states allow license number changes if you can prove identity theft or fraud. Contact your state DMV with documentation of the breach. Requirements vary by state.

What can criminals do with a stolen driver's license number?

They can open bank accounts, apply for loans, file fraudulent tax returns, or create fake physical IDs. Unlike credit cards, license numbers rarely change, so the risk persists for years.

Did AssuranceAmerica pay a ransom to the hackers?

The company has not responded to questions about ransom payments or direct contact with attackers. This remains unknown.

How did hackers breach AssuranceAmerica?

The company said hackers targeted an employee and that compromised credentials were disabled. The specific method, whether phishing, malware, or another technique, was not disclosed.

Source: TechCrunch / Zack Whittaker