After an insurer data breach: what drivers should do

When an auto insurer or an agency tells you your data was exposed, the most important line in the letter is the list of what was taken. A driver's license number with a name and birth date is the item that matters most in this industry, because it is hard to change and can be used to open accounts, file claims and impersonate you. The sensible response is to freeze your credit, watch the records insurers rely on (your CLUE report and your driving record), treat every follow-up message as suspect until you verify it, and ask your state about a flag or replacement for the license number.

This article treats a breach as a mechanism with a dated example, not as a news story. If someone has already used your identity, go to insurance identity theft: policies and claims in your name; this piece is about the stage before that, when the data is out and the misuse may not have begun.

What auto insurers hold about you

Insurers collect more than most drivers realize, because pricing and claims both require detail. The categories below are what a breach letter is likely to list.

State breach laws treat several of these as protected. Florida's statute, for example, defines personal information as a name combined with items such as a Social Security number, a driver license or identification card number, a financial account or card number with its access code, medical history or treatment information, health insurance identifiers, biometric data or geolocation, and also covers a username or email address combined with a password or security question that would give access to an online account (see Florida Statutes section 501.171). Your state's list may differ.

A dated example: quote tools and license numbers, 2020 to 2024

Breaches do not always look like a hacker smashing into a vault. Sometimes the entry point is a feature designed to give strangers information. A concrete, public example comes from New York.

In a November 25, 2024 announcement, the New York Attorney General and the state Department of Financial Services (DFS) said they had secured $11.3 million in penalties from GEICO and Travelers over data security failures that compromised the personal information of more than 120,000 New Yorkers. The announcement said the events were part of an industry-wide campaign by hackers to steal driver's license numbers and dates of birth from online auto insurance quoting applications, and that some of the stolen license information was then used to file fraudulent unemployment claims at the height of the COVID-19 pandemic.

The regulators described two different paths:

• GEICO. According to the announcement, starting in November 2020 GEICO experienced a series of attacks on its auto insurance quoting tools. Hackers obtained license numbers from its public website because, the regulators said, GEICO failed to protect the information on the website's back end. After that was fixed, they exploited vulnerabilities in the agents' quoting tool, a separate platform. About 116,000 New York residents were exposed, mostly through the agents' tool, and GEICO agreed to pay $9.75 million in penalties.
• Travelers. The announcement said that in April 2021 hackers used compromised agent credentials to enter an agent portal that could generate reports with full driver's license numbers in plain text. The portal was password protected but did not use multifactor authentication or another compensating control, and the company did not detect the intrusion for more than seven months, until a third-party prefill data provider alerted it. About 4,000 New Yorkers were affected, and Travelers agreed to pay $1.55 million.

The primary source for both is the DFS and Attorney General press release. Those are the regulators' findings and settlement terms as announced; the companies' own statements may differ, and settlements of this kind are generally reached without a full trial of the facts. The reason to know the story is the mechanism, which repeats across the industry:

1. A tool built to pull a driver's record or prefill a quote returns a license number to whoever uses it.
2. Criminals use stolen or guessed credentials, or automated lookups, to run it at scale.
3. The numbers are used elsewhere, in this case to file unemployment claims, not necessarily to buy insurance.
4. Months or years pass before the victim gets a letter.

That timeline is why the advice below focuses on freezes and monitoring rather than on waiting for evidence of harm. DFS also noted that its cybersecurity regulation, effective in March 2017 and amended effective November 2023, applies to its licensees; other states have their own rules.

What the law requires an insurer to tell you, and when

There is no single national deadline. All 50 states, the District of Columbia and several territories have laws requiring businesses to notify individuals of security breaches involving personal information, according to the National Conference of State Legislatures, which last updated its summary in January 2022. They differ in what counts as personal information, what counts as a breach, how fast notice must go out and who else must be told.

Florida's statute shows the typical structure, and it is stricter than some states':

• Timing. Notice to individuals must go out as expeditiously as practicable and without unreasonable delay, and no later than 30 days after the determination of a breach or reason to believe one occurred, unless law enforcement asks for a delay.
• State regulator. A breach affecting 500 or more people in the state must be reported to the state Department of Legal Affairs, in general within 30 days, with a possible 15 more for good cause shown in writing.
• Credit bureaus. If more than 1,000 people are affected, the entity must also notify the nationwide consumer reporting agencies.
• Content. The notice must state the date or estimated range of the breach, describe the personal information involved, and give contact information.
• Third parties. A vendor that holds the data and suffers a breach must tell the company within 10 days.
• An out. Notice to individuals is not required if, after investigation and consultation with law enforcement, the company reasonably determines the breach has not and will not likely result in identity theft or other financial harm, a conclusion that must be documented in writing and given to the state.

That last point means that no letter does not prove no breach. It may mean the company decided there was no likely harm.

Insurance regulators add a layer. The NAIC's Insurance Data Security Model Law (#668) says a licensee should notify the commissioner as promptly as possible and no later than 72 hours after determining that a cybersecurity event occurred, when the state is the insurer's state of domicile or when the licensee reasonably believes the information of 250 or more state residents is involved and a notice to a government body is required or the event is reasonably likely to cause material harm. The model also says the licensee must comply with the state's breach notification law as to consumers and send the commissioner a copy of the consumer notice. A model law is a template, though: states decide whether and how to adopt it, so check whether yours did. The text is at the NAIC model law page. For a broader view of who protects insurance data, see Who protects your insurance data: GLBA, state acts and your rights.

Reading your notice

When the letter arrives, go through it in this order.

1. Is it real? Breach notices are a favorite disguise for phishing. Do not click a link or call a number in the notice itself until you verify it. Look up the company on its official site or on your own account statements and find the breach page or phone line there. Our guide on car insurance phishing, text and call scams covers the red flags.
2. What was taken? Underline the data types. A license number, Social Security number, financial account number or medical detail changes your steps (see the table below).
3. When did it happen, and when was it found? The gap shows how long your data may have been in circulation.
4. What is offered? Free credit monitoring is common. Monitoring alerts you after something changes; it does not prevent misuse, so treat it as an add-on to a freeze, not a substitute.
5. Who else got it? Some letters come from an agency, a vendor or a data provider you never dealt with. The notice should say how they got your information.
6. What is the deadline? Some offers expire after enrollment windows.

Steps by type of data exposed

For app and device risks specifically, see Security and privacy risks of OBD dongles and driving apps.

Credit freezes and fraud alerts: what each does

The Federal Trade Commission's guidance is plain. A credit freeze is free to place and lift and blocks new credit accounts from being opened, including by you, until you lift it; you contact all three bureaus (Equifax, Experian and TransUnion). A fraud alert requires businesses to verify your identity before granting new credit but does not block access to your report; you contact one bureau, which notifies the other two. An initial alert lasts one year, and an extended alert lasts seven years but requires a filed identity theft report. The agency says you can freeze your credit at any time, without waiting for your data to be exposed or misused (see the FTC's page on credit freezes and fraud alerts).

For a license number alone, a freeze is the strongest low-cost step, since it blocks the most common misuse, new credit. A fraud alert adds identity checks at lenders. Neither controls your insurance records, which sit outside the credit bureaus, and a freeze does not stop an insurer from reviewing credit for underwriting; the Washington insurance commissioner says federal law lets insurers do that without lifting a freeze. If your quotes change after a freeze, ask for the adverse action notice and complain to your regulator if the reason is unclear.

Can a driver's license number be replaced?

Sometimes, but there is no national rule. Two states publish processes. Oregon says you may be eligible for a new driver license or ID card number if your name and number were used fraudulently, and asks for documentation such as a police report or a letter from a financial institution. Vermont will mark a license record "compromised" on receipt of your signed letter and a copy of the breach notification letter you received, and warns that you may then be asked for additional identification in future license transactions or when stopped by an officer. Both are described on the state pages: Oregon DMV and Vermont DMV.

If your state has no formal route, ask the motor vehicle agency whether it can note your file, require extra verification, or review any duplicate or replacement license request. Weigh the costs: a new number means updating your insurer, employer, lender and any account tied to it.

Watching your CLUE report and driving record

Because the license number is the key insurers use to match you to records, watch both records that carry it.

• CLUE report. LexisNexis's claims-history report generally holds up to seven years of auto and property claims, per the Washington insurance commissioner, and federal law entitles you to a free copy. Check for claims, vehicles or policies you do not recognize. The Consumer Financial Protection Bureau's list of consumer reporting companies, current as of January 2025, shows free report and freeze options for LexisNexis C.L.U.E. & Telematics OnDemand. Our guide on Pulling your own records: CLUE, MVR and claim file explains how to request it and dispute errors.
• Driving record. Order your motor vehicle record from your state. California's DMV, for example, offers an online driver's record for $2 as of November 2026. Look for violations, collisions or license actions you do not recognize.
• Registration and insurance letters. A DMV letter asking you to prove coverage on a vehicle you do not own is a red flag.

How often? A reasonable pattern after a license-number breach is once right away, then every few months for the first year, and again whenever you shop for insurance or get a rate change you cannot explain.

The department of insurance's role

Your state insurance department licenses insurers and agents, takes consumer complaints and, in states that have adopted the NAIC model law described above, receives reports of cybersecurity events from insurers. It cannot restore your data, but it can ask the company to explain what happened, check whether required notices went out, and examine the insurer's security practices. The NAIC keeps a directory of state insurance departments with complaint links. A complaint is worthwhile if the notice came late, omitted what was taken, offered no remedy or if you see misuse that traces back to the insurer. Our guide to how to file a complaint against a car insurance company covers the process. For disputes about money or fault, a licensed attorney is the right source of advice.

A worked example

Say you receive a letter in the mail from a national insurer you quoted with four months ago but did not buy from. It says an agent portal was accessed and that names, addresses, birth dates and driver's license numbers were exposed. These details are hypothetical.

1. Day 1. You find the insurer's breach page by typing its website into your browser, not by clicking the letter's link, and confirm the notice is real. You note the offered monitoring and its sign-up deadline.
2. Day 1. You freeze your credit with all three bureaus and save the confirmation PINs or log-ins.
3. Day 2. You request your CLUE report and order your driving record. Both are clean.
4. Day 3. You call your state motor vehicle agency, ask whether it can flag your record, and follow the instructions.
5. Month 1. You put a calendar reminder to re-check both records in three months, and again before your next renewal.
6. Month 4. A text arrives referencing your quote and asking you to "confirm your policy." You ignore it, report it to the insurer's published fraud address, and continue.

Common questions

Do I have to accept the free credit monitoring?

No. It can add a layer of alerts, but a freeze does more to prevent new accounts. Read the terms; some offers include enrollment prompts for paid services.

Can I sue the insurer?

Whether you have a claim depends on your state's law and the facts of the breach, including what was taken and whether you suffered harm. A licensed attorney can explain your options; the state insurance department handles regulatory complaints separately.

I never bought a policy. Why did the insurer have my data?

Quote requests, prefill lookups and agent tools can all store personal data for people who never bought a policy. In the New York case above, the data came from quoting tools. If you got a letter, you were likely in a quote, an application or a vendor's file.

Should I change my insurer after a breach?

That is your call and depends on the facts, the remedies offered and what regulators found. A breach by itself does not tell you how any company handles claims or service; look at the regulator's complaint data (see The NAIC complaint index: how to look up an insurer) and the facts of the incident, and note that no insurer is immune to attack.

Key takeaways

• The data types in the notice decide your steps; a license number with a name and birth date is the high-risk combination for auto insurance.
• Breach rules differ by state: notice often must go out within a set number of days (Florida's is 30), but a company may conclude there is no likely harm and send nothing.
• Freeze your credit with all three bureaus, since it is free and blocks new credit; a freeze does not control your insurance records.
• Watch your CLUE report and driving record and ask your state about flags or replacement numbers, since processes in states such as Oregon and Vermont show what is possible.
• Verify any follow-up message through the company's official site, and use your state insurance department if the notice was late, thin or followed by misuse.