Lemonade Data Breach

Attorneys working with ClassAction.org are looking into whether a class action lawsuit can be filed in light of the Lemonade data breach.

As part of their investigation, they need to hear from individuals who received a notice letter around April 2025 stating their driver’s license number may have been exposed.

On April 9, 2025, Lemonade, Inc. reported to the U.S. Securities and Exchange Commission (SEC) that a “technical issue” in its online application process for car insurance policies may have led to the exposure of approximately 190,000 individuals’ driver’s license numbers.

According to data breach notice letters sent to affected individuals (seen below), Lemonade’s online insurance application process involves prospective customers entering certain information—including their names, dates of birth and addresses—into the insurer’s website. Using this information, Lemonade then “calls for and returns” the person’s driver’s license number from its third-party data provider, the letter states. Lemonade learned on March 14, 2025 that “a vulnerability” in this insurance quote flow “likely exposed” certain driver’s license numbers.

The SEC filing specifies that driver’s license numbers were transmitted in unencrypted form “without Lemonade’s standard means of protection.”

The unauthorized exposures are believed to have occurred from approximately April 2023 to September 2024, the data breach notice states.

Although Lemonade said in the SEC filing that it believes customer data was not targeted and that the data breach was “not material,” the company reported the incident to several state attorneys general and mailed data breach notice letters to affected individuals around April 2025.

A class action lawsuit against Lemonade could help data breach victims recover money for loss of privacy, time spent dealing with the breach, out-of-pocket costs, and more.

A successful case could also force Lemonade to ensure it takes proper steps to protect the information it was entrusted with.

In fact, in May 2024, Lemonade reached a nearly $5 million settlement in a separate case that accused the company of illegally disclosing life insurance applicants’ personal and health-related information to third parties. The settlement provided cash payments to affected individuals and required Lemonade to stop its disclosure of sensitive information.