AssuranceAmerica
Insurance provider AssuranceAmerica has confirmed a data breach affecting nearly 7 million people. The exposed data includes driver's license numbers and, for some individuals, Social Security numbers, according to a notification letter filed with South Carolina's Department of Consumer Affairs (PDF).
How the breach happened and what was stolen
AssuranceAmerica detected suspicious activity on its IT systems on March 17, 2026. The letter traces that activity back to an attack the day before, on March 16, that targeted a single employee. An unauthorized third party used that access to get into the company's systems and copy a number of data files.
The company then had to review those files to figure out whose information was inside them, and what data was stolen. That review took three months, wrapping up on June 15. They determined that several categories of data were exposed: contact information, auto insurance policy or account details, driver or vehicle information, claims-related information, driver's license numbers, and, for some people, Tax ID information or Social Security numbers.
Breach notices from AssuranceAmerica are now reaching customers. Not every affected person had every category of data exposed in the breach. However, the company sent one form letter to cover a wide range of cases, so customers will not learn what data of theirs was taken.
What AssuranceAmerica is doing about it
The company says it disabled and took offline the affected server devices. It also reset passwords, deployed enhanced monitoring and threat detection software, retrained staff on cybersecurity, and notified law enforcement.
AssuranceAmerica is not offering free credit monitoring or identity theft protection to affected consumers. The consumer breach letter's advice is limited to reviewing your credit reports and bank statements and contacting your financial institution if you spot anything suspicious.
What you should do if you're affected
Whenever there's a risk of identity theft (as is almost always the case for most people), I recommend placing a security freeze or a fraud alert with the major credit agencies. Both stop thieves before a new account opens rather than just flagging one after the fact.
A security freeze is the stronger option. It blocks lenders from accessing your credit file at all, which means no one, including you, can open a new account until you lift it. It's free to place, lift, or remove, and it's the right call if you don't expect to apply for credit in the near term.
A fraud alert tells lenders to verify your identity more carefully before approving anything. That makes it the better choice if you're planning to apply for a loan, a mortgage, or new phone service soon, since a freeze would slow that process down. An initial fraud alert lasts 90 days and is free to set with any one of the three bureaus, which will notify the other two. If you confirm you've actually been a victim of fraud, file a police report and send it to the bureau to extend the alert to seven years.
Either way, contact all four consumer reporting agencies, not just the big three. Equifax, Experian, and TransUnion are standard, but Innovis is worth adding too, since it's smaller and easy to forget.
Watch for notices from your state's DMV about unauthorized attempts to use your driver's license number. The letter lists specific contacts (PDF) for residents of California, Kentucky, Maryland, New York, North Carolina, and Texas.
Be skeptical of any outreach claiming to be from AssuranceAmerica. Attackers now have enough personal details, including policy numbers and claims history, to make a phishing email or call very convincing. If you are contacted about an issue, you can reach AssuranceAmerica's customer service directly at 1-800-450-7857.
