A proposed class of approximately 190,000 individuals is asking the Southern District of New York for preliminary approval of a $10.5 million settlement with Lemonade Inc. The case concerns allegations that the insurer’s online quote platform negligently disclosed drivers’ license numbers to cybercriminals. The fact pattern in this case is very similar to a NYAG settlement we discussed last year.
According to the filings, Lemonade’s online quotation platform included an auto-populate feature that disclosed an individual’s driver’s license number when basic information was entered. That information included commonly-known things like name and address. Plaintiffs allege threat actors used the auto-populate functionality to obtain driver’s license numbers over a 17-month period. The threat actors then used this information to commit fraud and identity theft. As a result, Plaintiffs’ claims include violations of the New York General Business Law and the Federal Drivers’ Privacy Protection Act.
If approved, the proposed settlement would provide:
- $10.5 million total settlement fund;
- $55 payment per class member before deductions for fees, service awards, and other expenses; and
- three years of services valued at nearly $720 retail price per person (which could result in a net effective increase in the value of the settlement fund).
Lemonade has also agreed to equitable relief at its own expense. It will implement a three-year enhancement program to its data and information security measures.
Putting It Into Practice: This case is a reminder that creating online “prefill” forms for external-facing sites is not without risk. As companies launch new platforms or launch old ones, think about how they might fail or be exploited by threat actors.