Another Massive Data Breach Exposed Millions of Driver’s License Numbers

A major U.S. insurance provider has confirmed a far‑reaching data breach that has exposed the personal information and driver’s license details of nearly 7 million people, marking the largest known leak of Americans’ driver’s license records so far this year. The incident highlights the growing risk of identity‑related data being targeted and stolen from organizations across the public and private sectors.

Scope and Impact

AssuranceAmerica, which offers auto and rental insurance services to customers in more than a dozen states, confirmed that the breach affects approximately 6.9 million people, though official filings with state regulators put the figure even higher at 6.99 million. Founded in 1998, the company collects and stores large volumes of sensitive data as part of its underwriting, verification, and claims processes, including state‑issued driver’s license numbers, which are considered high‑value targets for cybercriminals.

In a formal notice sent to affected individuals and reviewed by TechCrunch, the company stated that hackers gained access to its systems and exfiltrated a broad range of information. The stolen data includes:

• Full names and contact details

• Driver’s license numbers and related identification information

• Auto insurance policy and account details

• Records of vehicles and additional drivers listed on policies

• Information related to customer claims history.

AssuranceAmerica did not specify whether other types of sensitive data, such as Social Security numbers, financial account details, or dates of birth, were also compromised, saying only that the investigation was complete and the identified information had been secured.

How the Breach Occurred

The company first detected unauthorized activity within its network on March 17, 2026, and launched a full investigation that concluded on June 15. While the exact technical details of the attack were not fully disclosed, AssuranceAmerica confirmed that the intrusion began when hackers targeted one of its employees, gaining access through compromised login credentials. The company said it immediately disabled the affected accounts and took steps to strengthen its security systems once the breach was discovered.

It remains unclear exactly how the credentials were obtained, but similar incidents in recent years have often been linked to common tactics: phishing emails that trick users into revealing passwords, malware designed to steal login information, or vulnerabilities in third‑party software and applications.

TechCrunch reached out to AssuranceAmerica CEO Joe Skruck and founder Guy Millner to ask whether the company had negotiated with the attackers, paid a ransom, or taken additional measures to protect customers. At the time of publication, neither executive had responded to the request for comment.

Official Confirmation and Notifications

The full scale of the incident was confirmed through filings with state regulatory bodies. In its submission to the Indiana Attorney General’s office, AssuranceAmerica listed the number of affected individuals at 6.99 million and stated that formal notification letters would be mailed out starting July 10.

A copy of the same notification, provided to TechCrunch by the Maine Attorney General’s office, also listed the same figure. Notably, Maine’s public data breach portal was temporarily taken offline and placed under review last month, after a fraudulent disclosure was mistakenly published on the site, raising questions about how such sensitive information is managed and shared at the state level.

Part of a Growing Trend

This incident is not an isolated case. It follows a series of high‑profile breaches in recent months that have exposed millions of government‑issued identity documents. In June 2026, the state of Texas revealed that hackers had accessed the systems of its Parks and Wildlife Department, stealing the driver’s license numbers and passport details of at least 3 million residents.

TechCrunch has also documented several other major lapses in recent times, including data leaks from hotel check‑in platforms, money transfer services, prison communication providers, and even a U.K. visa processing system. Together, these breaches have put millions of people’s official identification records into circulation on the dark web.

The rise in such incidents coincides with a broader shift in how online services operate: more websites and apps now require users to upload or share official identity documents, including driver’s licenses, to verify their age, identity, or legal status. This push has accelerated amid new government regulations around age verification and digital identity, but it also means that vast amounts of sensitive data are being collected and stored by more organizations than ever before, creating a larger attack surface for cybercriminals.

The Risk of Stolen Driver’s License Numbers

For consumers, the exposure of a driver’s license number carries serious risks. Unlike a credit card number, which can be canceled and replaced relatively easily, a driver’s license number is tied to a person’s legal identity and remains valid for years. In the hands of criminals, it can be used to:

• Open fraudulent bank accounts or lines of credit

• Apply for loans, government benefits, or insurance policies.

• Create fake identity documents.

• Gain access to other accounts linked to the person’s identity.

• Sell the information to other criminals on underground marketplaces

AssuranceAmerica has advised affected customers to monitor their accounts closely, review their credit reports regularly, and consider placing fraud alerts or credit freezes on their files to prevent unauthorized activity.