American Family Connect Insurance Company (CONNECT) notified people that between June 30 and August 20, 2026, an unauthorized party used its online auto insurance quoting process and may have obtained driver’s license numbers.
American Family Connect Insurance Company’s Data Breach Investigation
American Family Connect Insurance Company, which refers to itself in its notice as CONNECT, is an auto insurance carrier based in Madison, Wisconsin. Like most insurers, it offers an online quoting tool that lets shoppers enter personal details and receive a price for an auto policy. In late September 2026, the company sent a Notice of Data Breach dated September 30, 2026 and filed a copy with the California Attorney General. The notice describes an incident that began with a technical issue at the end of the online quoting process, not with a break-in to the company’s customer databases.
According to the notice, the company became aware of the technical issue, started an investigation with outside experts, and took steps to assess and respond. It states that the issue has been resolved, that none of its internal systems or databases, including those that store consumer information, were accessed, and that no policy information belonging to current or former customers was affected. On or about August 31, 2026, the company determined that some individuals’ personal information may have been affected.
The mechanism the company describes is worth understanding. Between June 30, 2026 and August 20, 2026, an unauthorized third party used certain personal information that it had already obtained from other sources to generate auto insurance quotes. In the course of that quoting process, the third party may have acquired the driver’s license number connected to the person whose details were entered. In other words, the people affected were not necessarily customers of the company at all. They may simply be individuals whose basic details were already circulating and were fed into the quoting tool by someone else.
This pattern is a known tactic in the insurance industry. Quoting tools often auto-fill or display a driver’s license number once enough identifying details are entered, because the number is used to pull driving records and set a price. Criminals who hold a list of names, addresses, and birth dates can run those details through the tool at scale and collect the license numbers that come back. The resulting numbers can then be combined with the information that was already stolen elsewhere to build a more complete profile of a person.
The company’s notice says the information involved was a driver’s license number. It does not say that Social Security numbers, financial account numbers, or payment card details were involved, and this page does not suggest they were. The filing also does not give a total number of people notified. The Rhode Island portion of the letter states that the incident involves 0 individuals in that state, which tells us only about that one state and not about the national total.
In response, the company says it strengthened security controls related to its quoting platforms and has not identified any further suspicious activity. It is offering single-bureau credit monitoring, a credit report, and a credit score service for 12 months through Cyberscout, a TransUnion company, along with fraud assistance. Recipients have 90 days from the date of the letter to enroll using the unique code in their notice, and a help line is available on weekdays from 8:00 a.m. to 8:00 p.m. Eastern.
A stolen driver’s license number is a more serious exposure than many people assume. It is a government-issued identifier that is difficult to change, and it is routinely requested to verify identity when someone applies for credit, files for unemployment or tax refunds, or opens an account. Fraudsters can pair it with a name and date of birth to attempt fake IDs, fraudulent applications, or account takeovers. Federal regulators advise people to stay vigilant for the next 12 to 24 months after a notice like this one, since stolen identifiers are frequently reused long after the original incident.
State breach-notification laws require companies to tell affected residents and, in many states, the attorney general when certain personal information is exposed. Those filings are how the public learns about incidents like this one. The key dates are the quoting activity from June 30 to August 20, 2026, the company’s determination around August 31, 2026, and the notice letter dated September 30, 2026.
When Did This Breach Occur?
The company states that the unauthorized quoting activity took place between June 30, 2026 and August 20, 2026. It determined on or about August 31, 2026 that some individuals’ information may have been affected, and its Notice of Data Breach is dated September 30, 2026. The company says the technical issue has since been resolved and that it has not seen further suspicious activity. It has not said exactly when it first noticed the technical issue.
What Information Was Breached?
According to the notice, the information involved was the affected person’s driver’s license number. The company says the unauthorized party already had certain personal information from other sources and used it to generate auto insurance quotes, and that the driver’s license number may have been obtained during that process. The company states that none of its internal databases were accessed and that no policy information of current or former customers was affected. It has not publicly listed any other data types.
What You Can Do
Enroll in the free credit monitoring if you received a letter, using the unique code in your notice within 90 days of the letter date. Review your credit reports from Equifax, Experian, and TransUnion at annualcreditreport.com, and consider a free fraud alert or security freeze. Watch for suspicious insurance quotes, unexpected accounts, or mail about services you did not request. If your license number is misused, you may want to contact your state motor vehicle agency, file a report at identitytheft.gov, and keep copies of any police report.
File a Data Breach Lawsuit Against American Family Connect Insurance Company
When a company’s systems expose a government-issued identification number, the people affected may have legal options. Data breach lawsuits commonly focus on whether a company used reasonable safeguards to keep consumer information from being harvested or misused. Whether you can take part depends on your own circumstances, including whether you received a notice and what was involved. An attorney can review your letter and explain what may be available to you.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
