Last week’s breach ledger was about architecture — one Oracle zero-day cascading through a dozen victims. This week’s is about time: the months-long gap between the moment your data walks out the door and the moment anyone bothers to tell you. Two of the three entries below involve delays that should embarrass everyone involved. The third involves a number so large it stops meaning anything, which is exactly why it’s worth slowing down for.

AssuranceAmerica: 6.99 million driver’s licenses, 115 days of silence

Georgia-based auto insurer AssuranceAmerica — which specializes in non-standard policies, meaning many of its customers are people who can least afford identity trouble — confirmed that hackers stole personal data on approximately 6.99 million people. That makes it the largest known breach of driver’s license numbers so far in 2026, ahead of the Texas state government incident that exposed 3 million licenses and passport records earlier this year.

The stolen haul includes names, contact details, driver’s license numbers, auto insurance policy and account information, vehicle details, and customer claims records. According to the company’s filings, the intrusion began after attackers targeted one of its employees — compromised credentials that were later disabled, which is corporate for “someone got phished.”

Now the timeline, because it’s the real story. AssuranceAmerica discovered the intruders on March 17. It completed its investigation on June 15. Notification letters started going out around July 10. That is nearly four months between discovery and disclosure — 115 days during which 6.99 million people had no idea their license numbers, addresses, and claims histories were circulating, no reason to freeze their credit, no prompt to watch for the insurance-themed phishing that this exact dataset makes devastatingly convincing.

Driver’s license numbers occupy an awkward tier of the identity stack: not as catastrophic as a Social Security number, but you can’t change them easily either, and combined with a name, address, and vehicle data they’re more than enough for synthetic identity fraud and fraudulent claims. The company hasn’t said whether it paid anyone, whether it communicated with the attackers, or answered press questions at all. Silence, again.

If you have an AssuranceAmerica policy (or had one): treat the notification letter as overdue confirmation, not fresh news. Freeze your credit with all three bureaus — it’s free — and be aggressively suspicious of any call or email referencing your actual policy or claims details. The scammers now have the same paperwork you do.

Accenture: the consultant’s keys are on the forum

Accenture — the consulting giant that enterprises pay to secure their own systems — confirmed a breach after a threat actor operating under the alias “888” offered roughly 35 GB of stolen data for sale on a hacking forum. The claimed contents are not customer gossip; they’re the crown jewels of a cloud estate: source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files.

Accenture’s statement is a small masterpiece of the genre: “We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery.” Note what’s missing — any word on whether client data or client-facing infrastructure details were in those 35 gigabytes, or how the attackers got in.

Here’s why this belongs in a privacy blog and not just a security trade rag: stolen cloud keys and configuration files are the raw material of downstream breaches. Accenture manages systems for governments, banks, and healthcare networks. When a firm at that altitude loses access tokens, the blast radius is measured in other people’s databases — potentially yours. This is also at least the third notable incident for the company, after the 2021 LockBit ransomware attack and a 2024 third-party leak of employee data that this same “888” persona tried to sell. “Isolated matter” is doing a lot of work in that sentence.

24 billion credentials, in one place, free for the taking

Researchers at Synthient and Malwarebytes reported an exposed compilation of roughly 24 billion stolen records — usernames, passwords, and associated account data — assembled from 36 sources: Telegram channels, older breach compilations, infostealer logs, and some datasets that appear to have been exported directly from live servers.

The instinctive response to a number like that is fatalism — everything’s already leaked, why bother. Resist it, because the composition matters more than the count. Compilations like this are mostly recycled, but infostealer logs are the fresh, dangerous fraction: malware on infected machines harvesting saved browser passwords, session cookies, and autofill data in real time. Those credentials are current, they’re tied to your actual devices, and they’re the fuel for the credential-stuffing attacks that quietly take over accounts at scale.

The defense hasn’t changed, which is precisely the point — it works: a password manager generating unique passwords per site, passkeys where offered, two-factor authentication everywhere that matters (authenticator app or hardware key, not SMS), and a periodic pass through Have I Been Pwned to see which of your addresses are in circulation. A 24-billion-record dump is only a threat to people who reuse passwords. Be someone it’s useless against.

The pattern

Three stories, one thread: in every case, the people whose data was taken were the last to know and the least able to do anything about it. AssuranceAmerica’s customers waited a season. Accenture’s clients are still waiting to hear whether they’re affected. The 24 billion credentials were traded through criminal channels long before researchers found the pile.

Breach-notification law in most US states still allows exactly the kind of leisurely timeline AssuranceAmerica followed. Until that changes, assume the disclosure you receive is months stale by design — and act on the day you learn, not the day they lost it.