- A threat actor claims to sell what is believed to be a database containing nearly 450,000 customer records stolen from top US auto insurer Clearcover.
- Data available for sale includes user names, addresses, car information, VINs, and odometers; however, no financial information or passwords are available.
- There is no confirmation from Clearcover of such a security breach, nor has any independent security researcher verified the authenticity of the alleged data.
A threat actor is offering a database, presumably belonging to U.S. digital auto insurance provider Clearcover, that contains data of hundreds of thousands of customers.
According to the actor’s post on a popular cybercrime website, the database is dated June 25, 2026. It reportedly contains 448,603 records, and the threat actor claims they’ll sell the dataset just once. They also published a sample of the records as proof to support the claim.
There is currently no public evidence that Clearcover suffered any breach or that the dataset in question is genuine.
What Data is Allegedly in the Database
The vendor claims that the dataset consists of personal and vehicle-related information usually found in car insurance databases.
According to the listing, the leaked data includes customers’ first name and last name, street address, city, state, and ZIP code. Moreover, according to the listing, the database also contains vehicles’ make, model, model year, category, and body type. There are also Vehicle ID numbers (VINs) and odometer details.
The post never mentioned if the database contains Social Security numbers, driver’s license details, payment cards, or bank account information. Also, the actor never mentioned whether it includes emails or passwords. Nevertheless, it is worth noting that even such basic pieces of data may be highly valuable to cybercriminals.
There is currently no way to verify the authenticity and completeness of the offered dataset, or directly from Clearcover’s systems.
Leaked Data May Facilitate Phishing and Insurance Frauds
If the information is accurate, then this will provide sufficient information for criminals to carry out a targeted scam.
Having information about the customer’s name, residence address, as well as his car will make the email or phone call more convincing. Scammers will pretend to be representatives of some insurance company, repair shop, or car company while citing authentic vehicle information to deceive victims.
Such data can also fuel more elaborate fraud schemes. A US man recently used dark web-purchased stolen identities to carry out a rental car fraud scheme that cost companies nearly $800,000.
VIN information may also be used in scams involving false recall, false repairs, or fake insurance schemes. Although VIN information is not confidential in nature, its use along with verified customer information may make scam messages more convincing.
Bad actors may use the information in combination with other stolen information from past breaches or from public records for identity theft.
Insurance companies possess substantial customer information and vehicle information, which may come in handy in fraud even without any financial information. For that reason, these companies and their customers became attractive targets for cybercriminals.
No Public Admission from Clearcover
As of the time of writing, Clearcover has not confirmed any cyberattack against the firm that corresponds to the claims made on the forum post. In addition, there have been no breach notifications, regulatory filings, or independent investigation to confirm the claims that the database belonged to Clearcover.
The sample data is not enough evidence to prove that the database actually exists or that it’s from Clearcover. Many cybercrime forums often feature listings of stolen data or recycled info from old breaches. Sometimes the claims are totally fake and are just there to lure potential buyers.
For now how the breach occurred, whether via direct compromise, third-party service provider, or affiliated insurance agency, remains unclear.
What’s Next?
Clearcover will probably do an investigation regarding the source of exposure, how the hacker accessed the data, and the scope of the incident (if any). Then they will notify customers who the incident affected in accordance with data laws.
There’s no reason for any Clearcover customer to take any immediate action right now. However, if you currently use Clearcover, or you have at any point in the past used their services, stay on the lookout for unexpected emails, text messages, or phone calls asking for your policy info, personal info, or payment details.
Until further evidence to verify the alleged database’s legitimacy surfaces, treat the alleged database sale as mere claims.
