American insurance company AssuranceAmerica has disclosed a data breach impacting nearly 7 million drivers after attackers gained access to its systems earlier this year. 

AssuranceAmerica operates through a network of over 9,500 independent agents and provides auto, renters, and commercial auto insurance coverage across 14 U.S. states.

While the company has yet to publish a press release regarding the incident, it revealed in a filing with Maine’s Office of the Attorney General that the data breach has exposed the information of 6,998,886 people.

As TechCrunch first reported, AssuranceAmerica detected the breach on March 17 and found that the attackers had stolen a wide range of customer information from its systems.

“On March 17, 2026, the Company detected suspicious activity involving certain Company systems that appears to have resulted from malicious activity on March 16, 2026 that targeted one of the Company’s employees. During the investigation, the Company determined that an unauthorized third party accessed certain portions of the Company’s informational technology (IT) environment and copied certain data files,” it notes in data breach notification letters that will be sent to affected people on Friday.

“The Company subsequently conducted a review of the affected files to identify individuals whose personal information may have been contained within those files. Because of the nature of the files involved and the scope of the required review, this file evaluation process was only recently completed (on June 15, 2026), and we are now providing this notice.”

As the company found, the stolen documents contained a combination of affected individuals’ names, contact information, automobile insurance policy or insurance account information, driver or vehicle information, claims-related information, and driver’s license numbers.

Since it detected the security breach, AssuranceAmerica disabled the credentials compromised in the attack, kicked the threat actors out of its network by disabling unauthorized sessions, isolated the affected systems, and notified law enforcement agencies of the incident.

“The Company also implemented additional measures designed to enhance the security of its IT systems and data, including resetting passwords, deploying enhanced monitoring and threat detection tools, and providing additional instruction to personnel regarding cybersecurity threats,” it added.

AssuranceAmerica also advised affected customers to immediately alert their financial institution if they detect any suspicious activity after reviewing credit reports, bank accounts, and other financial statements.

Last month, American insurance giant Aflac also disclosed a data breach after attackers compromised its Japanese subsidiary’s systems, stealing the personal and bank account information of 4.38 million customers.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

The agency is giving autonomous vehicle makers until the end of July to figure out a solution.

Last week, thousands of SamKnows routers were bricked after a government program ran its course.

In 2020, as part of a program conducted by the Australian Competition & Consumer Commission (ACCC), the Australian government’s chief competition regulator, thousands of volunteers received routers to help test and report on the typical speed and performance of broadband plans in Australia. (More specifically, the Measuring Broadband Australia (MBA) program targeted fixed-line broadband services provided over the NBN, Australia’s government-owned wholesale open-access broadband network, as well as services delivered over other access networks.)

According to the final report that the ACCC distributed, the routers are whiteboxes that were “supplied by SamKnows” and that “perform tests to measure internet performance using test servers maintained by SamKnows and hosted in Australia.”

Last month, the program concluded, and the ACCC released its final performance report (PDF). Subsequently, the routers used for the program were bricked after June 30.

Ars Technica reviewed a copy of an email that an MBA volunteer received in mid-June informing them that the program would end on June 30, 2026 and further stating:

Service Termination: Your whitebox will be disabled, and your SamKnows One account will be closed.

The email, signed by “The SamKnows Team (part of Cisco),” noted that after June 30, the devices would stop collecting data and that users’ “measurement and registration data will be deleted in accordance with our retention obligations under our end-user license agreement.”

However, as one MBA volunteer pointed out to Ars via email, the routers are still working, making the decision to disable the devices an avoidable e-waste risk.

When asked by Ars, the ACCC didn’t specify the number of SamKnows routers disabled last month. However, in a report about the MBA program released in December 2020 (PDF), the ACCC said it initially expected to release about 4,000 whiteboxes throughout the program’s duration and had distributed “over 2,600″ by December 2020. The report noted that the ACCC retained an “adequate pool of whiteboxes to allow for the expansion of our reporting to cover, for example, emerging [retail service providers] and new speed tier plans.”

Security

If people think you are doing a legitimate job, you can get away with anything

PWNED Welcome, once again, to PWNED, where each week we share the saga of an organization that couldn’t get out of its own way when it comes to security.

This week’s tale comes courtesy of Dahvid Schloss, a professional red teamer who was also involved (as a supervisor) in last week’s story about hackers shoveling snow in order to gain access to restricted areas. This time, it was Schloss himself who broke in, and he used the promise of better connectivity to do it.

On one assignment, Schloss was asked to test the physical and network security of a company that was near the top of the Fortune 500 and had a reputation for sponsoring and providing the trophy for an international sporting competition. According to him, there were three copies made of the trophy: one for the winner, one for the host nation itself, and one for the sponsor.

When Schloss was conducting his audit, the location he visited was undergoing construction, creating problems with the office Wi-Fi that all the employees noticed and hated. So when Schloss and his team invaded the place and started probing the wireless network, no one questioned them.

“So, you got three of us that are kind of walking through this campus with antennas sticking out of our laptops. We were not being secretive at all, but we figured this is California and there’s plenty of tech bros and nerds everywhere so antennas sticking out of a computer is not going to scare people,” Schloss said. “But everyone kept coming up to us – not to ask us if we were supposed to be there, but to ask us if we were going to fix the Wi-Fi.”

After wandering the building, Schloss and his team came to the marketing department where one of the trophies, which he estimates was worth at least $250,000 (or, perhaps, priceless as there are only three), was sitting in a case. Knowing that his job was to test overall security and not just network security, he opened up the case and proceeded to remove the trophy.

Someone from the marketing department saw Schloss pulling the trophy out of the case and talked to him while he was doing it. Their question: “Are you here to fix the Wi-Fi?” When he answered “yes,” the marketing people ignored him as he slipped the trophy into his backpack.

He took the trophy out of the building and held onto it for two and a half weeks, with no one saying anything about it. However, when it came time for him to give a presentation to the company executives, he brought the prize with him.

“We walked to the boardroom and the first thing I do in this boardroom is I pull out the trophy and I put it on the table,” Schloss told us. “And all these executives are sitting around there as we’re about to give this security report on where the maturity is at and that was like enough said, right? You could see the eyes just popping open.”

What we can learn from this story is that employees tend to trust people in the workplace, even outside contractors. If they think that someone belongs in the building, they won’t question that person’s motives, even if they see them doing wrong.

I’m reminded of a situation that took place at a job I was working at many years ago. It was around 6 pm and most people had left the office, but the cleaning lady was there sweeping up when I heard a commotion coming from my coworker’s cubicle. My colleague, who had been at the gym and left her wallet at her desk, returned to find the cleaner taking cash out of her wallet. 

At first I didn’t believe it and thought there must be a misunderstanding because the cleaning lady, unlike Schloss’ set of fake Wi-Fi repairmen, was legitimately supposed to be working that night. However, my coworker caught her red-handed and she later admitted stealing the money. 

So train your staff to question everyone, especially strangers who look like they belong in the building. ®

Japanese telecommunications giant KDDI revealed that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country.

KDDI is the second-largest mobile telecommunications provider in Japan, with 45,000 employees and annual revenue of $32.4 billion.

The company disclosed last month that it blocked the attackers’ access and implemented defensive measures after discovering the incident on June 17, and revealed that the breach impacted the STNet, JCOM, Chubu Telecommunications C, NIFTY Corporation, and BIGLOBE ISP operators.

KDDI added that the incident may have exposed the email addresses and passwords of up to 14,22 million current and former customers, as well as those belonging to inactive accounts. It also noted that some passwords were stored in hashed and/or encrypted form (making them harder to use for account hijacking), but did not specify how many accounts had passwords stored in plaintext or what type of encryption was used.

In a July 6 update, KDDI revealed that the attackers breached the platform on May 16 after exploiting a zero-day vulnerability in a third-party software.

“As a result of our investigation, as of June 17, 2026, the date of our confirmation, this vulnerability was not recognized by the software vendor,” KDDI said. “The software vendor has reported this vulnerability to public authorities and is working toward disclosing the information.”

Over 12 million email addresses exposed

The telecom giant is now working to secure affected email accounts after attackers gained access to the email addresses of 12,233,087 people and the passwords of 7,616,173 others.

“We are currently working to change the passwords of affected customers’ email accounts. To date, many customers, primarily those who regularly use email services, have already changed their passwords,” it said.

“In addition, to ensure the security of customers who do not frequently use email services, we are working to have ISP providers complete mandatory password changes within one or two days.”

Since the attack, KDDI has also deployed Endpoint Detection and Response (EDR) software to help detect future breach attempts and said that, on June 23, a forensic audit confirmed that the exploited vulnerability had been addressed and that the systems aren’t affected by other security issues.

KDDI also notified Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications after discovering the breach, and is currently working with affected ISPs to implement security measures to mitigate the risks arising from this exposure.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper