Another massive data breach this year has exposed millions of people’s personal information. This time, it happened at an insurance company.
AssuranceAmerica recently began notifying customers of a data breach affecting 6.9 million people, according to a data breach listing with the Indiana Attorney General’s Office.
The Atlanta-based auto and renters insurance company provides coverage in more than a dozen states, including Arizona, Ohio, South Carolina, Texas, and Virginia.
A copy of the notice sent to affected customers says the company first detected suspicious activity on parts of its information technology systems on March 17. The issue appears to have stemmed from malicious activity the day before that targeted one of the company’s employees.
AssuranceAmerica says it immediately launched an investigation and hired external computer forensic specialists to determine what happened. The investigation found that the company was hit by an attack that allowed an unauthorized third party to access its IT systems and copy data files.
Because of the nature and scope of the files involved, the company did not complete its review until June 15. That review found that some customers’ personal information was included in the stolen files, including names, contact information, auto insurance policy and account information, driver and vehicle information, driver’s license numbers, and potentially Social Security numbers.
Not much is known yet about who the attackers were or what they plan to do with the stolen data.
AssuranceAmerica did not immediately respond to a request for comment.
However, the company said in its notice to customers that it has taken steps to address the breach, including disabling affected server devices, resetting passwords, notifying law enforcement, and using more enhanced monitoring and threat detection software. It also said it has given employees additional instruction on cybersecurity threats.
Additionally, the company is urging affected customers to review their credit reports and bank accounts and contact their financial institutions if they notice anything suspicious.
Some of the states hit hardest by the breach include South Carolina and Texas, where more than 600,000 and 500,000 residents were affected, respectively.
One law firm is already considering a class action lawsuit for customers affected by the breach.
The data breach is the latest in a string of major incidents this year involving driver’s licenses and other government-issued IDs.
Last month, Texas Parks and Wildlife said there had been a breach involving the vendor system that handles its sale of hunting and fishing licenses.
An investigation by Texas Cyber Command found evidence that an unauthorized actor may have obtained driver’s license information, passport numbers, email addresses, phone numbers, and residential addresses belonging to more than 3 million Texans.
In May, TechCrunch reported that a Japanese hotel check-in system, Tabiq, accidentally left exposed online more than 1 million customer passports, driver’s licenses, and selfie verification photos from hotel guests around the world.
