A global breach that turned on the most ordinary failure there is — one stolen employee login. US auto insurer AssuranceAmerica has begun notifying almost seven million people that attackers used a single compromised staff credential to copy files containing names, policy details, driver's-licence numbers and — per state regulator filings — Social Security and tax ID numbers, in what's reportedly the largest exposure of American driver's-licence numbers this year. We walk the timeline from the 16 March credential theft to the 10 July notifications, weigh a nearly four-month disclosure gap and a notably lean response, and draw out the lessons: mandatory multi-factor authentication, collecting and keeping less identity data, and why how you treat people after a breach is part of security, not an afterthought.

Do you know whether one st ...