Farmers Insurance farmers.com Farmers Insurance data breach 2021: what happened and what to do
Between January 20 and February 12, 2021, attackers abused Farmers' online auto quoting tool to pull driver's license numbers. Farmers says they already had names, addresses or dates of birth. The notice filed in California gives no total count. Affected people got 12 months of Experian monitoring.
View all 13,115 breaches- Breach date
- 20 Jan 2021
- Made public
- 4 May 2021
- Data exposed
- Driver's licenses
- Last updated
What happened
Farmers Insurance told customers that between January 20 and February 12, 2021, unknown malicious actors targeted its online auto quoting system to obtain personal information. The company said that while it was still investigating how this happened, it believed the recipient's driver's license number may have been obtained. It filed a sample notice letter with the California Attorney General in 2021.
How it worked
According to the notice, the attackers already had certain personal details about their targets, such as a name, address or date of birth. They entered those details into the quoting tool and used it to get the driver's license number. Nothing in the notice describes a break into Farmers' core systems.
Farmers also warned that some people got the letter because they or someone in their household had made a genuine quote request in that window. Those people may not have been exposed.
What a driver's license number lets criminals do
A license number on its own can't empty a bank account. Paired with your name, address and date of birth, it helps criminals pass identity checks, file fraudulent unemployment or tax claims, or build a fake ID. That's why it's worth watching your credit even without a Social Security number in the leak.
Farmers' response
Farmers shut off access to the personal information and began identifying affected people. It retained CyberScout to help with credit reports, fraud alerts and monitoring, and offered 12 months of single bureau credit monitoring through Experian. Enrollment had to happen within 90 days of the letter date.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion is free and blocks most new accounts opened in your name. Lift it temporarily when you apply for credit.
- 2
Pull your free credit reports
Get them at annualcreditreport.com and look for accounts or inquiries you don't recognize. Report errors to the bureau straight away.
- 3
Ask your state about replacing the license number
Some states let you request a new license number if it's been compromised. Check your motor vehicle agency's website or call them.
- 4
Watch for unemployment and tax claims in your name
A letter from a state agency about benefits you never applied for is a warning sign. Contact the agency and report it at identitytheft.gov.
- 5
Check whether your email or phone number shows up in this and other breaches
Serus runs a free scan that checks your email and phone number against known breaches and the dark web, and alerts you when something new appears. It can't remove breach data, but it tells you what's out there so you know what to act on.
Frequently asked
Was I affected by the 2021 Farmers Insurance breach?
If you received a notice letter, Farmers believes your driver's license number may have been obtained. Some recipients may only have made a genuine quote request, so the letter doesn't prove exposure.
What data was exposed?
The notice says driver's license numbers. The attackers already had names, addresses or dates of birth and used them to look the number up.
How many people were affected?
The notice Farmers filed with the California Attorney General doesn't give a total.
Should I change my password?
Passwords weren't mentioned in the notice, so this breach doesn't require a password change. Focus on your credit and your license number.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
