Vertafore Hit with Class Action Over Data Breach Reportedly Affecting 27.7M Texas Drivers

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Vertafore, Inc.’s failure to adopt and maintain reasonable security measures allowed unauthorized parties to access the personal information of roughly 27.7 million Texas drivers in a data breach.

According to the lawsuit, the insurance software provider announced in November 2020 that Texas drivers’ personal information, including names, driver’s license numbers, dates of birth, addresses, and vehicle registration histories, had been stored on an unsecured external server that was accessed by unknown third parties sometime between March 11 and August 1, 2020.

The lawsuit alleges the data breach was a direct result of the defendant’s negligence and would not have occurred, or would have been discovered sooner, had the company employed adequate cybersecurity measures.

“Vertafore acted negligently in failing to adopt reasonable security protocols to prevent and detect the Data Breach,” the complaint reads. “Had Vertafore taken these measures, Plaintiff and Class members would not have been harmed.”

In connection with providing insurance ratings to its clients, among whom are more than 20,000 agencies, over 1,000 carriers, and 23 state governments, Vertafore has access to and stores Texas drivers’ personal information while promising to take “data privacy and security very seriously,” the lawsuit says. Despite Vertafore’s claims, however, the company has failed to “take even the most rudimentary steps” to secure drivers’ information, the suit alleges.

Per the complaint, the defendant improperly stored data on an unprotected server that posed little resistance to unauthorized parties who were able to access information that the suit says “included driver information for licenses issued before February 2019, contained Texas driver license numbers, as well as names, dates of birth, addresses and vehicle registration histories” of approximately 27.7 million individuals.

The lawsuit alleges Vertafore failed to discover the breach, which may have occurred as early as March 2020, until at least mid-August and then waited another three months before notifying affected individuals. According to the case, the delay added further injury to those whose data was compromised.

“As a result of this delay, Plaintiff and Class members had no notice whatsoever that their personal information had been compromised for months on end and were unable to take steps to proactively mitigate the harm caused by Vertafore’s Data Breach,” the complaint states.

Unlike credit card numbers, which can be quickly frozen in the event of a data breach, the personal information accessed in the Vertafore incident is “either irreplaceable or cannot be easily replaced,” the suit avers, noting that to replace a driver’s license number, an individual would need to file a police report and submit an application and various types of documentation and identifying details to a driver’s license office.

“In this case, that would be 27.7 million individual applications,” the case says.

Vertafore should have been well aware of the risk of a data breach yet failed to adhere to industry standards and guidelines issued by the Federal Trade Commission, the lawsuit goes on to allege.

According to the case, the data beach can be attributed to “deficient data security, inadequate data storage practices, and lax employee training and policies.”

The lawsuit claims those affected by the breach have been exposed to a heightened risk of identity theft and fraud as a result of the defendant’s negligence.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.