AssuranceAmerica data breach: auto insurance files copied after an attack on an employee

What happened in the AssuranceAmerica data breach?

AssuranceAmerica says it detected suspicious activity on part of its IT systems on March 17, 2026, which appears to have come from malicious activity the day before that targeted one of its employees. It hired outside forensic specialists, took the affected servers offline, reset passwords, added monitoring and threat detection software, gave staff more cybersecurity instruction and notified law enforcement.

Date	What the letter and the regulators' records say
March 16, 2026	Malicious activity targets an employee; breach date on the California, Washington and Indiana records
March 17, 2026	AssuranceAmerica detects suspicious activity
June 17, 2026	Notice recorded by California and Washington
June 23, 2026	First report logged in Massachusetts (3,569 residents)
June 26, 2026	First report posted on the Texas attorney general's list (500,987 Texans)
July 10, 2026	Date of notice in Indiana's report
October 14 to 16, 2026	Second reports in Massachusetts (17 residents) and Texas (88,640 Texans)

92 days passed between detection and the first state records. The letter says the file review took that long because of the nature of the files and the scope of the review. Texas and Massachusetts each logged a second, smaller report in October; the records do not say whether those cover new people.

What information was involved?

The letter lists each person's name and one or more of: contact information, auto insurance policy or account information, driver or vehicle information, claims information, driver's license number, tax ID information and Social Security number.

The state records differ by filing. Texas's first report lists Social Security numbers and financial information; its October report lists names, addresses, driver's license numbers and dates of birth, without Social Security numbers. Washington lists names and driver's license numbers. Both Massachusetts reports mark driver's licenses as breached and Social Security numbers, medical records, financial accounts and payment cards as not breached.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected, as reported to Indiana	6,998,886
Indiana attorney general	Indiana residents	237,141
Texas attorney general	Texans, June report	500,987
Texas attorney general	Texans, October report	88,640
Washington attorney general	Washingtonians	8,950
Massachusetts consumer affairs office	Massachusetts residents, June and October reports	3,569 and 17

Its 237,141 Indiana residents make it the third largest of the 1,361 notices sent in 2026 in Indiana's report (Indiana ranking).

The Indiana count of 237,141 residents is the third largest count of Indiana residents in its 2026 report. AssuranceAmerica is fourth in the national ranking from Indiana's report and appears in the Texas ranking.

What is AssuranceAmerica offering people who got a letter?

AssuranceAmerica offers 12 months of credit monitoring through IDX at no cost. Enrollment is at app.idx.us/account-creation/protect with the code printed at the top of each letter; the filed copy leaves the enrollment deadline and phone number blank, so each recipient's letter carries its own. The credit monitoring offers guide compares other offers.

What the documents leave open

• What the attack on the employee was: phishing, a stolen password or something else.
• Whose data the files held: AssuranceAmerica's own policyholders, or drivers on policies it administered for other insurers.
• Why Indiana's total is so much larger than the state counts.
• Whether the October filings add people or restate the June ones.

Was my Social Security number exposed in the AssuranceAmerica breach?

Possibly. The letter lists Social Security numbers as one of the types that may be in a person's records, and Texas's June report includes them, but Massachusetts marks them as not breached. Your own letter lists the items that apply to you.