Lemonade notifies car insurance customers of data breach involving driver’s license numbers

Lemonade data breach overview:

• Who: Lemonade Inc. sent data breach notifications to individuals affected by a vulnerability in its car insurance application system.
• Why: A system flaw in Lemonade’s online quote tool may have exposed customers’ driver’s license numbers.
• Where: The Lemonade data breach affects individuals nationwide who applied for auto insurance through Lemonade’s website.

Lemonade has begun notifying individuals that a flaw in its online car insurance application platform may have exposed customers’ sensitive personal information.

According to a notice mailed in April, Lemonade discovered on March 14 that a vulnerability in its “Online Flow” system may have allowed unauthorized access to driver’s license numbers. The exposure occurred between April 2023 and September 2024.

Lemonade detailed the incident in a filing with the U.S. Securities and Exchange Commission on April 9. In the filing, Lemonade disclosed that the technical flaw led to driver’s license numbers being transmitted in unencrypted form, without the usual security protections in place.

Lemonade explained that during the quote and purchase process, applicants provide personal information, including their name, date of birth and address. This data is then used to retrieve the individual’s driver’s license number from a third-party vendor. 

However, due to the system flaw, some of those license numbers may have been accessed without authorization.

Lemonade is an insurance company that offers renters, homeowners, car, pet and life insurance. 

Lemonade offers free identity protection after data breach

Lemonade says there is no evidence that any of the information has been misused. However, as a precaution, the company is offering 12 months of complimentary identity protection and credit monitoring through Identity Defense.

Affected individuals are encouraged to enroll using a personalized activation code before the listed deadline. 

Lemonade also advises customers to stay alert for suspicious activity, monitor their credit reports and consider placing a fraud alert or security freeze.

For additional information, affected individuals can contact Lemonade at 888-802-9720, available Monday through Friday, from 8 a.m. to 8 p.m. Central time.

In 2024, Lemonade agreed to a nearly $5 million class action settlement to resolve allegations that it shared life insurance applicants’ health information with third parties without consent.

Were you affected by this Lemonade data breach? Let us know in the comments.

Read About More Class Action Lawsuits & Class Action Settlements:

• Crocs sued for allegedly advertising fake discounts online
• Class action claims Beach Bunny Swimwear misled consumers with ‘hidden’ paid promotions
• SimpliSafe class action alleges company advertises false discounts
• Nike sued over deceptive ‘limited-time’ email marketing tactics