A new class action lawsuit alleges that digital insurer Lemonade has violated the privacy of as many as 190,000 drivers by exposing license numbers to cybercriminals through its online auto insurance quote platform.
The complaint filed in federal court in Manhattan accuses Lemonade of negligence in handling of individuals’ data and of violating the federal Driver’s Privacy Protection Act, New York business law, and Federal Trade Commission (FTC) data security guidelines.
Lemonade took two years to detect the technical glitch that caused the disclosure and while the insurer has said it would take prompt steps to fix the problem, according to the suit there is no evidence the insurer has done so. The plaintiffs seek costs and damages and a court order requiring that the insurer implement enhanced data security measures.
The lawsuit comes following an April 9, 2025 filing by the insurer with the Securities and Exchange Commission (SEC) in which it reported that its online application process for auto insurance policies may have exposed the driver’s license numbers of about 190,000 people from April 2023 to September 2024.
Lemonade acknowledged that a technical issue caused certain data to be transmitted without its “standard means of protection.” Lemonade also told the SEC that once it discovered the technical issue on March 14, 2025, it took “appropriate measures to resolve the vulnerability” and that it would begin notifying regulators and any individuals who might be affected. Lemonade described the matter as “not material.”
Lead Plaintiff
Arizona resident Leslie Rich, the lead plaintiff in the New York lawsuit, alleges that Lemonade was negligent in disclosing his driver’s license number and other personal information through its platform. As a result, Rich claims he was a victim of fraud and identity theft last October and November by criminals who obtained his personal information. He said fraudsters have applied for multiple auto loans with multiple lenders in his name and made fraudulent trades on his retirement account with Fidelity. In April, he received a letter informing him that Lemonade disclosed his driver’s license number to unauthorized third parties.
In essence, the suit maintains, Lemonade’s website functions as a driver’s license lookup tool, which scammers have used to access driver’s license numbers. The plaintiff claims Lemonade knowingly provides driver’s license numbers to any user who first enters a name and address and the insurer does not verify that a user is entitled to the information. In addition, the Lemonade platform does not employ effective security measures to detect whether a website visitor is, in fact, a “bot” or automated process rather than an individual person, according to the suit.
The quoting feature uses the name, date of birth, and address entered by the website visitor, combined with additional information Lemonade already has or can access from third-party data brokers, and then automatically “pre-fills” the driver’s license information.
The proposed class includes people—like Rich—who never applied for insurance with Lemonade and were not Lemonade customers. In other words, unauthorized parties availed themselves of the personal information that Lemonade made publicly available through its quote platform on a wholesale basis.
As a result, the suit claims, the insurer has “assisted an ongoing and concerted campaign by fraudsters to engage with insurers’ quote platforms to obtain driver’s license numbers to perpetuate known occurrences of fraud and identity theft.”
Lemonade sent letters to individuals impacted by the data disclosure beginning April 10, 2025. Thus, the complaint notes, Lemonade allowed the disclosure to continue for 17 months and failed to inform affected individuals of the data disclosure for .two years.
Other Actions
The lawsuit is the latest action against insurers with online quoting systems that are alleged to have exposed driver information.
New York Attorney General Letitia James has secured $975,000 in penalties from auto insurer Root over a data breach that the state says exposed the personal information of about 45,000 New Yorkers. Root does not offer insurance in New York, but scammers gained access to New Yorkers’ driver’s license numbers and personal information, according to the attorney general.
Previously, New York secured $5.1 million from GEICO and Travelers, as well as $500,000 from Noblr, for also failing to prevent data breaches of New Yorkers’ data.
In March, James sued Allstate Insurance and its subsidiary National General for allegedly causing driver’s license information on more than 165,000 New Yorkers’ information to be exposed in a cyber attack.
In 2024, Lemonade reached a $5 million settlement in a case accusing it of illegally sharing life insurance applicants’ personal and health-related information to third parties including TikTok, Facebook and Snapchat. The class action suit contended that Lemonade’s conduct violated consumers’ privacy rights as well as federal and state laws.
Topics
Lawsuits
Personal Auto
Interested in Lawsuits?
Get automatic alerts for this topic.
