Desk live·
ForensicPost
Insurance/Exposure/File 26-0918b

Lemonade’s Quote Tool Pre-Filled 190,644 Licence Numbers; the $10.5 Million Settlement Is Final

For 17 months the auto-quote form combined a visitor’s name, birth date and address with broker data and returned the driver’s licence number, including for people who never applied. Final approval came on 10 September, fourteen years after Nationwide’s quote form produced the first file of its kind.

Constructed geometry · not a chart of case data
JurisdictionUSANew Yorkthe affected organisation’s jurisdiction, not the actor’s suspected origin
TargetLemonade quote-form visitors
ActorUnattributed
D. Kennedy8 min readConfidence: high3 sources reviewed

A federal judge in Manhattan granted final approval on 10 September 2026 to a $10.5 million class settlement over Lemonade Inc.’s auto-quote platform, which between April 2023 and 18 September 2024 pre-filled driver’s licence numbers by matching visitor-entered names, birth dates and addresses against data-broker records. Unauthorised parties used the feature to harvest about 190,644 licence numbers, including those of people who never sought a Lemonade policy. Reporting of the approval followed on 18 September.

Lemonade discovered the exposure in March 2025 and notified in April. The settlement pays documented losses up to $10,000 or a pro-rata share, provides three years of identity protection, and sends a third of the fund to class counsel. The sources do not report an admission of liability.

The Same Form, Again

The corpus opened the quote-form thread at 12-1206, where Nationwide’s form was breached in 2012, and followed it through GEICO at 21-0419, Elephant at 22-0527b and the New York penalties at 24-1125b. Lemonade’s version is the most explicit: the form did not leak a stored number, it looked the number up from a broker and displayed it, so that a person with no policy and no account was included the moment somebody typed their name. New York fined eight other insurers more than $19 million for the same design in 2025.

Why The Design Persists

Pre-filling a licence number is a conversion feature. Every field a prospect must type is a reason to abandon the quote, and the number is the one field they may not have to hand. The broker feed exists to remove that friction. What it also creates is a lookup service for anyone with a name and a birth date, and the sector has now been told so by a regulator, by four courts and by fourteen years of files. The settlement is the cost of one more instance.

How we reported this

Compiled from Insurance Journal’s report of the final approval and legal-press coverage, listed below. The 190,644 figure is the settlement class’s. No separate New York penalty against Lemonade for this incident was found. Graded high. Corrections: corrections@forensicpost.com.

Sources
  1. Lemonade $10.5 Million Settlement Over License Number Data Breach ApprovedInsurance Journal
  2. Lemonade Gets Final OK For $10.5M Data Breach SettlementLaw360
  3. Lemonade settlement over licence number exposure, 21 September 2026Claims Journal
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary