A function that allowed customers to have their driver license information prefilled online when applying for a car insurance quote has led to thousands of people’s personal information being exposed, a new nationwide class action alleges.
Plaintiff Alp Baysal filed the class action lawsuit against American Family Insurance Company, S.I. and its subsidiary, Midvale Indemnity Company, Tuesday in a Wisconsin federal court.
Baysal says the companies, which provide insurance products to Americans across the country, violated the Drivers’ Privacy Protection Act and were negligent in their handling of consumer information on their websites.
“Defendants readily provided Plaintiff’s and putative Class Members’ driver’s license number to anyone who entered a person’s name, address and/or date of birth into their on-line quoting system,” the claim states.
“Thus, customers, prospective customers, and even members of the public who were not even prospective customers of Defendants, had this sensitive personal information compromised.”
Baysal says he was one of these members of the public. He had never requested a quote from either of the defendants, but on May 13 this year he received notice from Midvale that his personal information had been exposed to unauthorized third parties.
The class action lawsuit explains that the companies provide online automobile insurance quotes to consumers through the amfam.com website.
To make the quoting process easier for consumers, an American Family third-party supplier prefills certain information in the online quoting form — such as driver’s license number — after a consumer enters personal information into the form. Midvale does the same through the midvaleinsurance.com website.
However, as reported by the companies, unauthorized parties used an automated bot process to obtain driver’s license numbers by entering personal information such as name and address into the quoting platform. The bots were operating between Feb. 6 and March 19 this year for American Family customers, and between Jan. 19 and 29 for Midvale customers,
“This means that for an unknown period of time between at least January 19 and March 19, 2021, Plaintiff’s and Class Members’ drivers’ license numbers were essentially publicly available to anyone on various Defendants’ online platforms due to Defendants’ lax security practices.”
American Family reported that 283,734 unique driver’s license numbers were returned in the pre-fill information for all quotes that were generated during the period.
“Plaintiff and the Class are now at much higher risk of identity theft and for cybercrimes of all kinds, especially considering the highly valuable and sought-after private PI stolen here,” the class action alleges.
Baysal is looking to represent a nationwide Class of United States residents whose personal information was compromised in the situation announced May 13.
He is seeking an injunction, certification of the class action, an order to delete Class member information and improve security, damages, interest, fees costs and a jury trial.
Meanwhile, in 2013, American Family Insurance agreed to a class action lawsuit settlement over allegations it made improperly low payments on claims submitted through its automobile Medpay coverage.
What do you think of the allegations of insecurity on the American Family websites? Let us know in the comments!
The plaintiffs are represented by David W. Asp, Kate M. Baxter-Kauf and Karen Hanson Riebel of Lockridge Grindal Nauen PLLP.
The American Family Data Breach Class Action Lawsuit is Alp Baysal et al., v. Midvale Indemnity Company et al., Case: 3:21-cv-00394, U.S. District Court Western District of Wisconsin.
Don’t Miss Out!
Check out our list of Class Action Lawsuits and Class Action Settlements you may qualify to join!
Read About More Class Action Lawsuits & Class Action Settlements:
Cellphone wrong-number robocalls could be worth $500-$1,500 per violation of the federal TCPA
October 22, 2026 | TCPA Class Action Lawsuits
