American Family CONNECT Data Breach

For seven weeks, someone used stolen personal details to run fake auto insurance quotes on the CONNECT website and may have walked away with people’s driver’s license numbers.

American Family Connect Insurance Company (“CONNECT”) is a direct auto and home insurer owned by American Family Insurance, based in Madison, Wisconsin.

According to its Notice of Data Breach letter, CONNECT found a technical issue at the end of its online auto insurance quoting process. The investigation found that between June 30, 2026 and August 20, 2026, an unauthorized third party used personal information obtained from other sources to generate auto insurance quotes. As part of that process, the third party may have acquired people’s driver’s license numbers.

CONNECT says it determined on or about August 31, 2026 that personal information may have been affected. Notice letters are dated September 30, 2026.

How Fake Insurance Quotes Exposed Driver’s License Numbers

This was not a typical hack of a company database. CONNECT says none of its internal systems or databases were accessed, and no current or former customer policy information was affected.

Instead, the third party already had some personal information, such as names and addresses, from somewhere else. It entered that information into CONNECT’s quote tool, and the tool may have returned the matching driver’s license number. CONNECT says the technical issue has been fixed.

That means people may be affected even if they never got a quote from or bought a policy with CONNECT.

How Many People Were Affected?

CONNECT’s letter does not give a number. CONNECT reported to the Indiana Attorney General that 52,798 people were affected in total, including 477 Indiana residents. CONNECT also filed with the California Attorney General.

The activity ran for about seven weeks before it stopped, and letters went out about three months after it began.

What Information Was Exposed?

According to the notice letter:

• Driver’s license number

The person behind the quotes also already held other personal details, such as names, that were used to run the quotes.

Why a Stolen Driver’s License Number Matters

A driver’s license number is a key that unlocks other fraud. Criminals have used license numbers to file fake unemployment claims, open bank and credit accounts, pass identity checks, and create fake IDs. Unlike a credit card, a license number is hard to change.

Affected individuals can take these steps:

• Enroll in the free credit monitoring within 90 days of the letter date
• Place a free credit freeze with Equifax, Experian and TransUnion
• Watch for unemployment or benefits letters you did not apply for
• Ask your state DMV whether you can get a new license number if you see fraud

What Is CONNECT Offering Affected Drivers?

CONNECT is offering 12 months of free single-bureau credit monitoring, a credit report and credit score through Cyberscout, a TransUnion company, plus fraud assistance.

• Enrollment deadline: within 90 days of the letter date (letters are dated September 30, 2026, so about December 29, 2026)
• Help line: 1-833-516-8757, Monday through Friday, 8 a.m. to 8 p.m. Eastern Time
• Unique code: printed on each person’s letter

What Legal Options Do Affected Drivers Have?

Insurers that collect and display personal information through their websites have a legal duty to protect it. When that duty is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the American Family CONNECT data breach?

CONNECT reported 52,798 people affected to the Indiana Attorney General. Its notice letter does not state a number.

What information was exposed?

Your driver’s license number may have been acquired. The person behind it already had other personal details from other sources.

I never got a quote from CONNECT. Why did I get a letter?

The third party used your personal information, obtained elsewhere, to run quotes in your name. You did not need to be a customer to be affected.

When do I need to enroll in the free monitoring?

Within 90 days of your letter date. For letters dated September 30, 2026, that is about December 29, 2026.

What should I do if I received a letter?

Take these steps:

• Enroll with Cyberscout using your code
• Freeze your credit
• Watch for benefits or unemployment claims in your name
• Call 1-833-516-8757 with questions

Could scammers use this breach to contact me?

Yes, that is a common follow-up risk. Scammers sometimes send emails, texts or calls that mention a real breach by name to seem trustworthy. Do not click links or share codes or passwords with anyone who contacts you about the breach. Use the phone number printed on your official letter instead.

Do I have a legal claim?

Possibly. Insurance companies that collect driver’s license numbers and other personal information have a duty to protect it and to tell people promptly when it is exposed. If that duty was not met, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.