Credit Freeze Alone Won’t Protect You

Notification letters from a company called AssuranceAmerica began arriving in mailboxes on July 10 — and if one reached yours, you are among 6,998,886 people whose driver’s license numbers, insurance records, and in many cases Social Security numbers were stolen in a March cyberattack. The breach is the largest known exposure of Americans’ driver’s license data in 2026, as documented in Indiana and Maine AG filings. A credit freeze is your first and most important step — but it is not your only one, because your driver’s license number enables three distinct categories of fraud, and a freeze only blocks one of them.

What Happened at AssuranceAmerica

Atlanta-based AssuranceAmerica Managing General Agency, LLC is not a company most policyholders know by name. It underwrites non-standard auto and renters insurance through more than 9,500 independent agents across 14 states, and it collects the full range of data an insurance underwriter requires: names, contact details, vehicle records, claims histories, and state-issued identification numbers for every driver on every covered policy. That data profile is what made it a target.

On March 16, 2026, an attacker targeted one of AssuranceAmerica’s employees and obtained that person’s login credentials. By March 17 — within roughly 24 hours — the company detected the suspicious activity, disabled the compromised credentials, terminated the unauthorized sessions, isolated the affected systems, and notified law enforcement. The attacker’s lateral movement through the company’s IT environment, and the depth of the data copied, were not determined until a forensic investigation concluded on June 15.

That 90-day investigation gap is the central accountability question. State breach notification laws in most jurisdictions start the consumer-notification clock at the conclusion of a company’s investigation — not at the moment of detection. On that measure, AssuranceAmerica notified consumers roughly 25 days after its investigation ended on June 15. Under the stricter standard — measured from the day the company detected unauthorized access — the gap between detection and notification was 115 days. Multiple law firms have already launched class action investigations citing that interval.

The unanswered question that will shape the company’s regulatory and legal exposure is simpler: was phishing-resistant multi-factor authentication deployed on the targeted employee account? AssuranceAmerica has not disclosed this. The company’s CEO and founder did not respond to questions from TechCrunch, including whether a ransom was paid. The MFA gap matters because if no phishing-resistant authentication was in place on an account that gave a single attacker access to nearly seven million people’s identity files, the failure is architectural — not a matter of bad luck.

What Was Taken From Your File

The stolen files contained names and contact information along with at least one of the following: automobile insurance policy or account information, driver or vehicle information, claims-related information, and driver’s license numbers. For a subset of affected individuals — those whose notification letters specify it — the stolen files also contained Social Security numbers and Tax IDs. Your letter specifies which data types apply to your case.

South Carolina alone confirmed 611,046 affected residents. The breach touched current and former customers, and named drivers on policies — meaning someone whose name appeared on a family policy, but who never directly contacted AssuranceAmerica, may have received a notification letter.

The specific combination of data matters. Driver’s license numbers, insurance claims histories, vehicle information, and contact details together constitute what security researchers describe as a rich identity profiling dataset. Unlike passwords or credit card numbers, these identifiers cannot be cancelled and reissued. A driver’s license number, once in criminal hands, remains useful to fraudsters for years.

Credit Freeze Stops One Vector. Your License Enables Three.

A credit freeze — formally called a security freeze — blocks consumer reporting agencies from releasing your credit file to lenders evaluating new credit applications. Under federal law since 2018, freezes are free and must be placed within one business day of an online or phone request. A freeze does not affect your existing accounts, does not affect your credit score, and can be temporarily lifted when you legitimately need to apply for credit.

But a credit freeze addresses only new-account financial fraud — loans, credit cards, and lines of credit opened in your name. Your driver’s license number enables two additional fraud categories that a credit freeze does not touch:

Criminal identity theft. When a thief uses your license number to create a forged or synthetic identification and is then detained for a traffic violation, their false information — your information — enters law enforcement records. The first indication a victim often receives is an unexpected court summons, an arrest warrant, or police appearing at their home. This risk does not appear on a credit report and is not blocked by a credit freeze. Driver’s license numbers can enable this form of impersonation even years after the breach.

Synthetic identity fraud. A thief who combines your driver’s license number with a Social Security number — both of which were exposed in this breach for some individuals — can construct a synthetic identity that mixes real and fabricated data. Fraudsters build credit histories on synthetic identities over months before exploiting them. The fraudulent accounts are linked to the real victim’s SSN, not to a credit file the victim monitors. Synthetic identity fraud has become one of the fastest-growing categories of financial crime globally, and the combination of a driver’s license number with a Social Security number is particularly valuable to fraudsters who assemble these fabricated identities.

This is why your action checklist has more than one item.

Your Action Checklist: Eight Steps, Three Categories of Protection

Step 1: Read your letter and note which data types are listed.

Your notification letter specifies which categories of your information were involved. Save the letter — you may need it for disputes or legal proceedings. If your letter names Social Security numbers or Tax IDs alongside driver’s license information, treat the entire checklist below as urgent.

Step 2: Freeze your credit at all three bureaus (free, ~5 minutes each online).

You must freeze each bureau separately. A freeze at Equifax provides no protection at Experian or TransUnion. Go to each of the following:

Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or call 1-888-298-0045 Experian: experian.com/help/credit-freeze/ or call 1-888-397-3742 TransUnion: transunion.com/credit-freeze or call 1-800-916-8800

A 2018 federal law requires that credit freezes be free and placed within one business day of your online or phone request.

When you legitimately need to apply for credit, you can temporarily lift the freeze at the relevant bureau — the bureau must act within one hour of your online or phone request — and re-freeze afterward.

Step 3: Enroll in the IDX monitoring offer if your letter includes one.

Some notification letters — availability varies by state — include an enrollment code for 12 months of free IDX credit monitoring and identity theft protection. Check your letter for a code and a deadline. If your letter includes one, enroll before the deadline. IDX monitors dark web exposure, sends alerts when your information appears in new breaches, and provides identity restoration assistance. If your letter does not include a monitoring offer, proceed to the steps below, which are entirely free.

Step 4: Place a fraud alert (optional, easier than a freeze).

A fraud alert instructs lenders to take additional identity verification steps before opening a new account in your name. Contact any one of the three bureaus and they are required to notify the other two. An initial fraud alert lasts one year and requires no documentation. An extended fraud alert, available to confirmed identity theft victims, lasts seven years. A fraud alert provides less protection than a freeze but does not require lifting before legitimate credit checks.

Step 5: Contact your state DMV.

Because the stolen data includes driver’s license numbers, contact your state’s Department of Motor Vehicles to ask about placing an identity theft flag on your record. Some state DMVs will issue a new driver’s license number to confirmed identity theft victims; policies and procedures vary by state. This step addresses the criminal identity theft vector that a credit freeze cannot block.

Step 6: Monitor your insurance records for unauthorized claims or policy changes.

The stolen files included claims histories and policy account information — data that could support fraudulent insurance claims filed in your name. If you notice policy changes you did not authorize or claims you did not file, contact AssuranceAmerica directly at the phone number in your notification letter (available Monday through Friday, 9 a.m. to 5 p.m. ET). You can also write to: AssuranceAmerica Managing General Agency, LLC, Attn: Data Incident Response, 100 Galleria Parkway SE, Suite 8000, Atlanta, GA 30339.

Step 7: Check your free credit reports.

Visit AnnualCreditReport.com for free reports from all three bureaus. Look for accounts, inquiries, or addresses you do not recognize. If you find unauthorized activity, dispute it directly with the relevant bureau and file a report at IdentityTheft.gov, the FTC’s official identity theft recovery portal, which generates a personalized recovery plan.

Step 8: Run a self-background check to catch criminal identity theft.

Signs of driver’s license-based criminal identity fraud do not appear on credit reports. They surface in motor vehicle records, law enforcement databases, and criminal background files. Contact your state DMV to request your official driving record and review it for activity you do not recognize. You can also request an Identity History Summary from the FBI, which searches for criminal records associated with your identity. Alternatively, your local sheriff’s office or police department may provide similar information at no charge.

Why Insurance Companies Keep Getting Breached

AssuranceAmerica’s breach belongs to a documented pattern. Credential-based attacks — in which an attacker targets one employee’s login rather than exploiting a software vulnerability — have become the dominant entry point for cyber losses across the insurance sector. Coalition’s 2026 Cyber Claims Report found that business email compromise and funds transfer fraud together accounted for 58 percent of cyber incidents in 2025.

In 2025, the cybercrime group known as Scattered Spider conducted systematic attacks against multiple major U.S. insurance companies within weeks of each other, using help desk impersonation to obtain credential resets. Aflac and Erie Insurance were among the targets identified in that campaign. No public source has attributed the AssuranceAmerica breach to Scattered Spider or any named group, and the specific method by which the employee’s credentials were obtained has not been confirmed.

What the pattern makes clear is structural. Insurance companies and managing general agencies accumulate large databases of identity-rich files because their business requires it — underwriting a policy requires knowing who the driver is, what they have claimed before, what vehicle they drive, and where they live. A single credential that provides access to a system holding that data for nearly seven million people is not a minor security gap. Given the credential-based nature of this attack, security analysts note that the central unanswered question is whether phishing-resistant multi-factor authentication was deployed on the compromised account — a control that, if absent, makes this type of credential theft significantly easier.

What AssuranceAmerica Is Offering — and What It Is Not

AssuranceAmerica has implemented standard containment measures: resetting passwords, deploying enhanced monitoring and threat detection tools, taking affected servers offline, and providing additional cybersecurity instruction to employees. The company notified law enforcement.

On the question of consumer remediation, the company’s position is conditional. Not every affected individual will receive a free monitoring offer. Whether your letter includes an IDX monitoring enrollment code depends on your state of residence and applicable state law. The company’s notification language states that some recipients “may be eligible” for identity protection services “depending on applicable legal requirements.” If your letter does not include an enrollment code, the protective steps above — all of which are free — remain available to you regardless.

Multiple law firms have launched class action investigations and are accepting free case evaluations from affected individuals. Searching for “AssuranceAmerica data breach lawsuit” will surface current filings and firm contact information.

Quick Reference: Who to Contact

---

Frequently Asked Questions

Did I have to be a direct AssuranceAmerica customer to be affected?

No. AssuranceAmerica is a managing general agency — an insurance intermediary that handles underwriting and policy administration on behalf of insurers through a network of independent agents. If your name appeared on any policy underwritten through AssuranceAmerica’s platform — including as a named driver on someone else’s auto policy — your information may have been in the company’s files, whether or not you ever contacted AssuranceAmerica directly. Your notification letter confirms your information was included.

Does a credit freeze protect against driver’s license identity theft?

Only partially. A credit freeze prevents new credit accounts — loans, credit cards, lines of credit — from being opened in your name without your authorization. It does not protect against criminal identity theft, in which a thief uses a forged version of your identification during a traffic stop or arrest, and it does not protect against synthetic identity fraud targeting government benefits, DMV records, or insurance systems. For complete protection after driver’s license exposure, a credit freeze must be combined with DMV notification, self-background checks, and ongoing monitoring of your motor vehicle record. Each step addresses a different, non-overlapping fraud vector.

What is the single most important thing I should do today?

Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion — separately and in that order. Each freeze takes approximately five minutes online and is free under federal law. Do not confuse a credit freeze with a credit lock; a freeze is a statutory right guaranteed by the Fair Credit Reporting Act, while a lock is a commercial product. After freezing, contact your state DMV and check your most recent credit reports at AnnualCreditReport.com. If your letter specifies that your Social Security number was among the stolen data, these steps are urgent today, not this week.

How long after a breach can identity fraud appear?

Identity-based fraud tied to driver’s license numbers and Social Security numbers can surface months or years after the initial breach. Unlike stolen credit card numbers — which become useless once the card is cancelled — driver’s license numbers and SSNs retain their value to fraudsters indefinitely because they cannot be cancelled and reissued. The 6.99 million individuals affected by this breach face elevated risk not just for the coming weeks but for years. This is why setting up long-term monitoring through your bureau freeze alerts, IdentityTheft.gov, and periodic self-background checks is more protective than a single action taken today.

This article is for informational purposes only and does not constitute legal advice. If you believe you have suffered financial harm as a result of this breach, consult a licensed attorney.