Summary
- Environment: Insurance quote API used by business partners
- Operational impact: Personal information obtained; no broader outage established
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 18, 2026; updated as evidence emerges.
What happened
AssuranceAmerica Managing General Agency detected suspicious requests to an insurance quote API on August 27, 2026. Its notice says the September 8 investigation finding established that information had been improperly obtained. [1]
Impact
Potentially affected fields included names, driver’s license numbers, addresses, email addresses, phone numbers and birth dates. The company said it had no indication of misuse at notice time. [1]
The South Carolina registry records 22,952 affected South Carolina residents. This is a state-specific count, not a national total. [2]
Timeline
Suspicious requests detected
The company detected unauthorized quote-system activity.
[1]Information impact identified
Investigators identified improperly obtained personal information.
[1]State report received
The regulator recorded the report and state resident count.
[2]Briefing updated
This briefing was last reviewed and updated on October 18, 2026.
Threat Group & Attack Vector
The activity involved one application programming interface endpoint that returned quotes to business partners. [1]
The reviewed notice does not establish the access start, credential misuse or a specific vulnerability.
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
AssuranceAmerica stopped the activity, blocked identified source addresses and engaged forensic investigators. It described the investigation as substantially complete, was reviewing security improvements and offered one year of credit monitoring. [1]