Another massive data breach exposed millions of driver’s license numbers

U.S. insurance provider AssuranceAmerica has confirmed a data breach affecting the personal information and driver’s license numbers of 6.9 million people, making it the largest known spill of Americans’ driver’s license information this year.

Founded in 1998, AssuranceAmerica provides car and rental insurance to customers across more than a dozen U.S. states. As a large insurance provider, the company handles large amounts of information about prospective insurance customers and vehicle drivers, including their personal information and details about their state-issued driver’s licenses. In the hands of a malicious person, a driver’s license number can be used for fraud and impersonation.

In a data breach notice sent to customers and seen by TechCrunch, AssuranceAmerica said it discovered hackers in its computer systems on March 17. The company concluded its investigation on June 15, finding that the hackers had stolen customers’ names, contact information, and driver’s license numbers. 

The breach notice said the hackers also took information about customers’ auto insurance policies and accounts, their drivers and vehicles, and details about customer claims. 

The company did not provide specifics about which other types of personal information were taken.

AssuranceAmerica did not specify the specific cause of the breach, but noted that the hackers “targeted one of the Company’s employees” and that the company subsequently “disabled compromised credentials.” It’s unclear how those credentials were stolen, but prior incidents involving stolen employee credentials have been linked to password-stealing malware or the use of compromised software.

TechCrunch emailed questions about the incident to AssuranceAmerica CEO Joe Skruck and founder Guy Millner, including asking if the company had any contact with the hackers or paid a ransom. Neither responded.

According to a data breach listing with the Indiana attorney general’s office, AssuranceAmerica listed the breach as affecting 6.99 million people, with notification letters set to be sent out on July 10.

A separate copy of AssuranceAmerica’s data breach notification, shared by the Maine attorney general’s office at TechCrunch’s request, also lists the number of affected people at 6.99 million. (Maine’s data breach portal is currently offline and under review after a fraudulent breach disclosure was published on its website last month.)

The incident at AssuranceAmerica follows a spate of data breaches affecting driver’s licenses and other identity documents in recent months. In June, the Texas state government said hackers stole information about at least 3 million driver’s licenses and passport numbers during a data breach affecting the state’s parks and wildlife division.

TechCrunch has previously reported on several security lapses that together spilled millions of government-issued identity documents, including incidents with a hotel check-in system, a money transfer app, a prison payphone provider and a U.K. visa service. These data spills come as websites and apps are increasingly demanding web users turn over their identity documents to prove they are legally old enough to access them, amid a global push by governments to roll out age verification laws.