Quick answer
Driver's license numbers were exposed. You may be affected even if you've never been a CONNECT customer, because the attacker used information from other sources to request quotes. CONNECT is offering 12 months of free credit monitoring. Enroll, and watch for fraud that uses your license number, like fake auto insurance claims or unemployment applications.
What happened
CONNECT says a technical issue at the end of its online auto insurance quoting process let an unauthorized third party, using personal information obtained elsewhere, generate quotes and possibly see driver's license numbers. This happened between June 30 and August 20, 2026. The company determined on or about August 31, 2026, that personal information may have been affected, and says the issue has been fixed.
CONNECT says its internal systems and customer databases were not accessed, and no policy information of current or former customers was affected. It doesn't say how many people were affected.
This kind of attack has hit several auto insurers in recent years. Criminals use quote tools to collect license numbers, which can help them file fraudulent unemployment claims or create fake IDs.
What information was exposed
- Driver's license number
What to do now
- Enroll in the 12 months of free credit monitoring from Cyberscout, a TransUnion company, at bfs.cyberscout.com/activate using the code in your letter. You have 90 days from the date of the letter.
- Watch for mail about an unemployment claim, insurance policy, or traffic ticket you don't recognize. Report a fake unemployment claim to your state workforce agency right away.
- Ask your state's motor vehicle agency what it recommends. Some states will flag or replace a license number that's been misused.
- Consider a free credit freeze at Equifax, Experian, and TransUnion. It stops anyone from opening new credit in your name, and you can lift it any time.
- Watch for scam calls, texts, and emails that mention this breach. Scammers often pose as CONNECT or American Family or a "breach settlement" service. Don't share passwords, codes, or payment details, and contact CONNECT or American Family using a number you look up yourself.
Ask CONNECT to delete your data
Fewer copies of your information means less to steal next time. If you requested a quote but never bought a policy, CONNECT may still hold that quote information. Insurers can keep some records the law requires, and financial information covered by the federal Gramm-Leach-Bliley Act (GLBA) is generally exempt from state deletion rights, but quote data from people who never became customers may still be deletable.
Your legal right to deletion
If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, CONNECT generally has to respond to your deletion request within the deadline your state sets, though some insurance records may be exempt. See what your state's law requires.
Find every company that has your data
A breach is a good reminder of how many companies hold your information. DataTrail scans your inbox (read-only) to find them all, flags the ones with data breaches, and writes the deletion requests for you to send.
Become a testerSource: California Attorney General breach notice. DataTrail isn't affiliated with CONNECT. This page is general information, not legal advice.