Nearly 7 million drivers' license numbers stolen in the AssuranceAmerica breach - what to do if you're one of them

If you've ever bought car insurance through AssuranceAmerica, your details may be in criminal hands. The Atlanta-based insurer confirmed this month that a breach exposed the personal information of about 6.9 million people - names, contact details, auto-policy information, and, most damagingly, driver's license numbers, with Social Security or tax ID numbers caught up in it for some customers. It's the largest known spill of Americans' license data so far this year.

The timeline the company gave is worth noting: attackers phished an employee and used the stolen login to get in on March 17, the investigation wrapped on June 15, and notification letters only started going out around July 10. So the criminals sat on this data for months before anyone was told.

A driver's license number isn't something you can change like a password, which is what makes this kind of leak sting. Two practical moves help most. Consider a free credit freeze at the three big bureaus so nobody can open accounts in your name. And be extra suspicious of the phishing that always follows a breach like this - a call or email that already knows your name, address and policy details sounds convincing precisely because the data is genuine. A real insurer won't ring out of the blue and ask you to "confirm" your identity; hang up and go to the company's own site.

Turn on two-factor authentication or a passkey wherever your money lives while you're at it. Tendvane's Privacy & accounts check shows how your sign-in accounts are protected so you can shore up the weak ones - and if a breach-driven phishing link ever lands something on your PC, its Safety check surfaces unexpected startup programs and browser extensions.