\n<\/p>\n
U.S. insurance provider AssuranceAmerica has confirmed a data breach affecting the personal information and driver\u2019s license numbers of 6.9 million people, making it the largest known spill of Americans\u2019 driver\u2019s license information this year.<\/p>\n
Founded in 1998, AssuranceAmerica provides car and rental insurance to customers across more than a dozen U.S. states. As a large insurance provider, the company handles large amounts of information about prospective insurance customers and vehicle drivers, including their personal information and details about their state-issued driver\u2019s licenses. In the hands of a malicious person, a driver\u2019s license number can be used for fraud and impersonation.<\/p>\n
In a data breach notice sent to customers and seen by TechCrunch<\/a>, AssuranceAmerica said it discovered hackers in its computer systems on March 17. The company concluded its investigation on June 15, finding that the hackers had stolen customers\u2019 names, contact information, and driver\u2019s license numbers.\u00a0<\/p>\n The breach notice said the hackers also took information about customers\u2019 auto insurance policies and accounts, their drivers and vehicles, and details about customer claims.\u00a0<\/p>\n The company did not provide specifics about which other types of personal information were taken.<\/p>\n AssuranceAmerica did not specify the specific cause of the breach, but noted that the hackers \u201ctargeted one of the Company\u2019s employees\u201d and that the company subsequently \u201cdisabled compromised credentials.\u201d It\u2019s unclear how those credentials were stolen, but prior incidents<\/a> involving stolen employee credentials have been linked to password-stealing malware<\/a> or the use of compromised software<\/a>.<\/p>\n TechCrunch emailed questions about the incident to AssuranceAmerica CEO Joe Skruck and founder Guy Millner, including asking if the company had any contact with the hackers or paid a ransom. Neither responded.<\/p>\n According to a data breach listing with the Indiana attorney general\u2019s office, AssuranceAmerica listed the breach as affecting 6.99 million people, with notification letters set to be sent out on July 10.<\/p>\n A separate copy of AssuranceAmerica\u2019s data breach notification, shared by the Maine attorney general\u2019s office at TechCrunch\u2019s request, also lists the number of affected people at 6.99 million. (Maine\u2019s data breach portal is currently offline and under review<\/a> after a fraudulent breach disclosure was published on its website last month.)<\/p>\n The incident at AssuranceAmerica follows a spate of data breaches affecting driver\u2019s licenses and other identity documents in recent months. In June, the Texas state government said hackers stole information about at least 3 million driver\u2019s licenses and passport numbers<\/a> during a data breach affecting the state\u2019s parks and wildlife division.<\/p>\n TechCrunch has previously reported on several security lapses that together spilled millions of government-issued identity documents, including incidents with a hotel check-in system<\/a>, a money transfer app<\/a>, a prison payphone provider<\/a> and a U.K. visa service<\/a>. These data spills come as websites and apps are increasingly demanding web users turn over their identity documents to prove they are legally old enough to access them, amid a global push by governments to roll out age-verification laws<\/a>.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n