Insurance company AssuranceAmerica exposes 6.9 million drivers after major data breach – here’s what we know

AssuranceAmerica reports breach affecting 6,998,886 customers, with attackers stealing credentials and exfiltrating sensitive insurance and driver data
The company reset passwords, isolated systems and implemented improved monitoring; warns victims of phishing risks using stolen details
No group has claimed responsibility, and stolen data has yet to appear on the dark web, although ransom tactics are common in such cases

AssuranceAmerica, an insurance company that operates thousands of independent agents across the United States, has confirmed that it suffered a cyber attack in which it lost sensitive data on nearly seven million customers.

The company filed a new report with the Office of the Maine Attorney General confirming the breach and sharing a copy of the notification letter it will soon send to the 6,998,886 affected individuals.

In the report, the company said an unidentified threat actor stole login credentials and moved into the network, obtaining names, contact information, auto insurance or insurance account information, driver or vehicle information, claim-related information and driver’s license numbers.

Data can be used for phishing

The attackers were discovered on March 17, 2026 and were quickly locked out of the company’s network.

Affected systems were isolated and law enforcement was notified. AssuranceAmerica also reset everyone’s passwords, implemented enhanced monitoring and threat detection tools and warned its staff to remain vigilant.

AssuranceAmerica has warned customers to be wary of incoming emails and other communications, especially those claiming to be from the company itself.

Using the information obtained in the breach, criminals can create highly convincing emails, trick victims into making fraudulent payments, share login information to corporate and banking environments, or even download malware and ransomware.

So far, no one has claimed responsibility for this attack, and the data has yet to appear anywhere on the dark web. Usually, criminals would post snippets or samples on their websites in an attempt to pressure the victim company into paying a ransom for the files.

Bleeping Computer Notes AssuranceAmerica operates through a network of more than 9,500 independent agents offering auto, renters and commercial auto insurance coverage in 14 US states.