A federal district court in New York has approved a $10.5 million class action settlement by digital insurer Lemonade over its exposing license numbers of as many as 190,644 drivers to third parties through its online auto insurance quote platform.
The case consolidated complaints brought by three plaintiffs from New York, Connecticut and Arizona on behalf of themselves and others affected by the quoting platform’s data breach, even if they were not Lemonade customers and never even applied for insurance from Lemonade.
The quoting feature uses the name, date of birth, and address entered by the website visitor, combined with additional information Lemonade already has or can access from third-party data brokers, and then automatically “pre-fills” the driver’s license information.
The claimants maintained that Lemonade’s website essentially functioned as a driver’s license lookup tool, which scammers have used to access driver’s license numbers. The plaintiffs claimed Lemonade knowingly provides driver’s license numbers to any user who first enters a name and address and the insurer does not verify that a user is entitled to the information. In addition, Lemonade does not employ effective security measures to detect whether a website visitor is, in fact, a “bot” or automated process rather than an individual person, according to the suit.
The complaints said the license plate exposure due to the security flaw went on for 17 months between April 2023 and September 2024. It took Lemonade almost two years to discover the flaw in March 2025 and then did not disclose the vulnerability letters to affected individuals until April 2025, two years after the breaches began.
The plaintiffs accused Lemonade of negligence in handling of individuals’ data and of violating the federal Driver’s Privacy Protection Act, New York business law, Connecticut Unfair Trade Practices Act, and Federal Trade Commission (FTC) data security guidelines.
Class Claims
Under the settlement approved by U.S. Magistrate Judge Katharine H. Parker in the Southern District of New York, class members will be able to submit claims for a documented loss payment up to $10,000 and/or a pro rata cash payment. Class members will also get three years identify theft protection and credit monitoring with three credit bureaus.
The approved class includes people who never applied for insurance with Lemonade and were not Lemonade customers because “unauthorized parties availed themselves of the personal information that Lemonade made publicly available through its quote platform on a wholesale basis,” according to the lawsuit.
