Lemonade to Pay $10.5M Settlement Over Driver’s License Data Breach On April 16, 2026, insurtech company Lemonade agreed to a $10.5 million settlement in a proposed class-action lawsuit filed in the U.S. District Court for the Southern District of New York. The case stems from a data breach in which Lemonade’s online quote platform allegedly exposed the driver’s license numbers of over 190,000 individuals to cybercriminals. The plaintiffs accused the company of negligence, claiming its security measures failed to protect sensitive personal data. The settlement, subject to preliminary court approval, resolves claims from affected customers who argued their information was improperly disclosed due to inadequate safeguards. The breach highlights growing concerns over data security in digital insurance platforms, particularly as companies increasingly rely on automated systems for customer interactions. The case underscores the legal and financial risks businesses face when handling personally identifiable information (PII). No further details on the breach’s timeline or the attackers’ methods have been disclosed.

Lemonade Inc. Reaches $10.5 Million Settlement Over Data Exposure Affecting 190,000 Individuals A proposed class of nearly 190,000 individuals has filed for preliminary approval of a $10.5 million settlement with insurtech company Lemonade Inc. in the Southern District of New York. The case centers on allegations that Lemonade’s online quote platform exposed drivers’ license numbers to cybercriminals due to a flawed auto-populate feature. According to court filings, the platform disclosed driver’s license numbers when users entered basic personal details, such as name and address. Plaintiffs claim threat actors exploited this functionality over a 17-month period, using the stolen data to commit fraud and identity theft. The lawsuit alleges violations of New York General Business Law and the Federal Drivers’ Privacy Protection Act. If approved, the settlement would include: - A $10.5 million fund for affected individuals. - A $55 payout per class member before deductions for fees and expenses. - Three years of identity protection services, valued at nearly $720 per person, potentially increasing the settlement’s total value. Lemonade has also agreed to implement a three-year data security enhancement program at its own expense. The case highlights risks associated with online prefill forms and the potential for exploitation by threat actors.

Lemonade, Inc. suffered a data breach reported by the California Attorney General, where unauthorized access exposed driver’s license numbers of identifiable individuals. The incident occurred between April 2023 and September 2024, though the breach was formally disclosed on April 11, 2025. While the exposed data included sensitive personal identifiers (driver’s license numbers), there is currently no confirmed misuse of the compromised information. The breach highlights vulnerabilities in Lemonade’s data protection measures, raising concerns over potential identity theft or fraud risks for affected individuals. The company has not provided details on the attack vector, but the exposure of government-issued identification numbers categorizes this as a significant data leak with potential long-term repercussions for customer trust and regulatory compliance.