Another massive data breach exposed millions of driver’s license numbers

U.S. security supplier AssuranceAmerica has confirmed a information breach affecting the idiosyncratic accusation and driver’s licence numbers of 6.9 cardinal people, making it the largest known spill of Americans’ driver’s licence accusation this year.

Founded successful 1998, AssuranceAmerica provides car and rental security to customers crossed much than a twelve U.S. states. As a ample security provider, the institution handles ample amounts of accusation astir prospective security customers and conveyance drivers, including their idiosyncratic accusation and details astir their state-issued driver’s licenses. In the hands of a malicious person, a driver’s licence fig tin beryllium utilized for fraud and impersonation.

In a information breach announcement sent to customers and seen by TechCrunch, AssuranceAmerica said it discovered hackers successful its machine systems connected March 17. The institution concluded its probe connected June 15, uncovering that the hackers had stolen customers’ names, interaction information, and driver’s licence numbers. 

The breach announcement said the hackers besides took accusation astir customers’ car security policies and accounts, their drivers and vehicles, and details astir lawsuit claims. 

The institution did not supply specifics astir which different types of idiosyncratic accusation were taken.

AssuranceAmerica did not specify the circumstantial origin of the breach, but noted that the hackers “targeted 1 of the Company’s employees” and that the institution subsequently “disabled compromised credentials.” It’s unclear however those credentials were stolen, but prior incidents involving stolen worker credentials person been linked to password-stealing malware oregon the usage of compromised software.

TechCrunch emailed questions astir the incidental to AssuranceAmerica CEO Joe Skruck and laminitis Guy Millner, including asking if the institution had immoderate interaction with the hackers oregon paid a ransom. Neither responded.

According to a information breach listing with the Indiana lawyer general’s office, AssuranceAmerica listed the breach arsenic affecting 6.99 cardinal people, with notification letters acceptable to beryllium sent retired connected July 10.

A abstracted transcript of AssuranceAmerica’s information breach notification, shared by the Maine lawyer general’s bureau astatine TechCrunch’s request, besides lists the fig of affected radical astatine 6.99 million. (Maine’s information breach portal is currently offline and nether review aft a fraudulent breach disclosure was published connected its website past month.)

The incidental astatine AssuranceAmerica follows a spate of information breaches affecting driver’s licenses and different individuality documents successful caller months. In June, the Texas authorities authorities said hackers stole accusation about astatine slightest 3 cardinal driver’s licenses and passport numbers during a information breach affecting the state’s parks and wildlife division.

TechCrunch has antecedently reported connected respective information lapses that unneurotic spilled millions of government-issued individuality documents, including incidents with a hotel check-in system, a money transportation app, a prison payphone provider and a U.K. visa service. These information spills travel arsenic websites and apps are progressively demanding web users crook implicit their individuality documents to beryllium they are legally aged capable to entree them, amid a global propulsion by governments to rotation retired property verification laws.