Aviva is writing to tens of thousands of motorists after concerns that two employees sold details of people who had recently had accidents to claims companies.
Hundreds of them have since received calls from firms to persuade them to make personal injury claims.
The employees have been dismissed and police have arrested two people on suspicion of fraud.
Aviva has apologised to customers and alerted the authorities.
Bryan Comley has had his car insured with Aviva for several years.
Two years ago he was hit by another motorist.
No one was injured and the claim was quickly settled.
However, soon afterwards, Mr Comley started receiving calls to his mobile from claims companies, saying there were thousands of pounds set aside for him because of the accident.
He thought that Aviva had passed on his details to the claims companies, as he told BBC Radio 4’s Money Box programme: “They said they were acting on Aviva’s behalf almost, some of them.”
Mr Comley did not think there was much he could do about it: “I assumed this was normal industry practice, that a car insurance company would disclose this information to third parties. I didn’t know any better.”