GEICO told customers in a letter dated April 9, 2021, that fraudsters had used information acquired elsewhere to obtain their driver’s license numbers through the online sales system on its website between Jan. 21 and March 1, 2021. The letter said the company had reason to believe the numbers could be used to apply fraudulently for unemployment benefits. TechCrunch reported the notice on April 19. GEICO did not disclose how many people were affected.
The mechanism was the quote form. An auto insurance quote tool that pre-fills a license number from a name and address is a convenience for genuine customers and a lookup service for anyone else. The corpus filed the same design at Nationwide in 12-1206, breached by exploit; here no exploit was needed.
What The Regulator Found Later
The New York Department of Financial Services’ consent order of November 2024, filed at 24-1125b, described three separate events. The quoting application had sent full license numbers to the browser in its responses. A claims flow exposed them after fraudulent policy purchases. An open API behind the agent sales portal, with its address visible in public page source, was queried from as early as November 2020, about 75 times by late January 2021, then at 10,000 to 25,000 queries a day from Feb. 24 until March 1.
GEICO found the third event on March 1, the day it stopped, through messages from the attackers offering to sell the data back and a tip from someone who had fallen out with them. The regulator had sent an informal alert on Jan. 28 and an industry-wide fraud alert on Feb. 16. About 116,000 New Yorkers were affected across the events.
Why A License Number Mattered In 2021
The pandemic unemployment programs verified claimants by driver’s license. A valid number attached to a real name and address was enough to file, and states were paying out at a speed that made verification an afterthought. The quote tool was the cheapest source of the one field the fraud needed. The harm landed on state benefit systems and on the people whose claims were filed before their own.
Compiled from GEICO’s notification letter as filed with the California attorney general, contemporaneous reporting and the 2024 New York consent order, listed below. GEICO published no national count; the 116,000 figure is New York’s. The query volumes are the regulator’s findings. Graded high. Corrections: corrections@forensicpost.com.
- GEICO Notice of Data Breach, April 9, 2021California Attorney General
- Geico admits fraudsters stole customers’ driver’s license numbers for monthsTechCrunch
- Geico data breach exposed customers’ driver’s license numbersBleepingComputer
- Consent order, GEICO, Nov. 25, 2024New York Department of Financial Services