6.99 million driver's licenses, one insurance company, one phished employee

AssuranceAmerica, a car and rental insurance provider operating in more than a dozen US states, has confirmed that hackers stole personal data belonging to 6.99 million people. The stolen data includes names, contact information, and driver's license numbers, along with details about customers' insurance policies, their vehicles and drivers, and their claims history. It is the largest known breach of driver's license information reported so far in 2026. (TechCrunch)

What actually happened

According to the breach notice AssuranceAmerica sent to customers, the company discovered hackers inside its systems on March 17 and closed out its investigation on June 15, almost exactly three months later. Notification letters were set to go out on July 10. The company said the attackers "targeted one of the company's employees," which is a polite way of describing what usually turns out to be a phished login or stolen credentials, the same pattern behind a long line of recent breaches involving password-stealing malware or compromised third-party software. (TechCrunch)

AssuranceAmerica has not said exactly how the credentials were obtained, and when TechCrunch asked the company's CEO and founder whether they had contact with the hackers or paid a ransom, neither responded. That silence is fairly typical. Companies rarely confirm ransom payments even when they make one, partly for legal reasons and partly because admitting it invites more attacks.

Part of a bigger pattern

This is not an isolated event. In June, the Texas state government disclosed that hackers stole at least 3 million driver's licenses and passport numbers from its parks and wildlife division. Earlier in the year, separate incidents exposed identity documents through a hotel check-in system, a money transfer app, a prison payphone provider, and a UK visa portal. Driver's license numbers keep showing up in these breaches because more services now require them for identity or age verification, which means more companies are storing them, and more of them are one phished employee away from a leak. (TechCrunch)

It also was not a quiet week otherwise. Japanese telecom giant KDDI confirmed a breach of an email platform shared by five internet service providers, ultimately affecting around 12 million accounts and exposing 7.6 million passwords, and IT consulting giant Accenture confirmed a separate breach after a hacker claimed to have stolen 35GB of source code and internal credentials. (Privacy Guides)

What to actually do if you were affected

A driver's license number by itself is not as immediately dangerous as a credit card number, but it is a durable piece of identity, it does not expire on a schedule, and it is often enough combined with a name and address to open credit or pass a weak identity check. If you are an AssuranceAmerica customer, or a customer of any insurer in a state the company operates in, a few concrete steps are worth taking. Place a free credit freeze with all three credit bureaus rather than just a fraud alert, since a freeze blocks new accounts outright instead of just flagging them. Watch for any DMV notice about a duplicate or reissued license request you did not make. And treat any unexpected insurance or auto loan offer that arrives in the mail with more suspicion than usual for the next year, since stolen policy and vehicle details make for convincing bait in follow-up scams.

None of this is a reason to panic, but it is a reason to spend fifteen minutes doing the credit freeze instead of putting it off. Breach notices like this one tend to land in a pile of mail people skim and forget, and the fifteen minutes now is a lot cheaper than untangling fraud later.

Why this is the kind of story I keep coming back to

I build small, no-account, on-device iOS apps, and stories like this one are a big part of why I hold that line. Every account you create somewhere is a database row that can end up in a breach notice years later, tied to a company you may not even remember signing up with. It does not mean every app should be account-free, insurance companies obviously need to know who their customers are, but it is a reminder that data you hand over does not disappear when you stop thinking about it. It sits in someone's system until either they secure it well enough forever, or one employee has a bad day.

General information, not legal or financial advice. For the studio's privacy-first, on-device apps, the full lineup is at jcmobileappstudio.com/apps.