Data Breach Hits AssuranceAmerica Exposing Personal Information of Nearly 7 Million People

AssuranceAmerica said it learned of a data breach on March 17 after detecting suspicious activity on its information technology systems. The Atlanta-based insurer said an investigation determined an unauthorized actor compromised its IT infrastructure on March 16 and copied files containing personal information. According to a regulatory filing with the Office of the Maine Attorney General, the breach affected 6,998,886 people. Notification letters sent to victims said the exposed data included contact information, automobile insurance policy or account information, driver or vehicle information, claims-related information, driver's license numbers, Tax ID information and Social Security numbers. AssuranceAmerica said the attacker targeted an employee by phishing to gain initial access. The company said it has revoked compromised login credentials, ended active sessions, isolated or shut down affected systems, notified authorities and hired external cybersecurity experts. It also said it implemented additional security measures, including resetting passwords and deploying enhanced monitoring tools. According to a breach notice filed with California's Attorney General's office, AssuranceAmerica is offering a 12-month credit monitoring service with IDX. The company advised victims to monitor financial accounts and credit reports and to notify financial institutions of any suspicious activity.