Insurance Firm Lemonade Says API Glitch Exposed Some Driver's License Numbers (securityweek.com)
(Tuesday April 15, 2025 @11:30PM (BeauHD)
from the PSA dept.)
- Reference: 0177030917
- News link: https://yro.slashdot.org/story/25/04/15/2025249/insurance-firm-lemonade-says-api-glitch-exposed-some-drivers-license-numbers
- Source link: https://www.securityweek.com/insurance-firm-lemonade-says-api-glitch-exposed-some-drivers-license-numbers/
An anonymous reader quotes a report from SecurityWeek:
> Insurance firm Lemonade is notifying roughly 190,000 individuals that their driver's license numbers were [1]likely exposed due to a technical glitch . Copies of the notification letter that were submitted to regulators in several states show that the incident involved an online application that enables individuals to obtain car insurance quotes and purchase policies. According to the company, a vulnerability in the car insurance quote flow resulted in the exposure of certain driver's license numbers for identifiable individuals. The vulnerability has been addressed, Lemonade says.
>
> Between April 2023 and September 2024, the platform transmitted the information unencrypted, which the company says allowed driver's license numbers to be accessed without authorization. "We have no evidence to suggest that your driver's license number has been misused but we are providing this notice as a precaution to inform potentially affected individuals and share some steps you can take to help protect yourself," the company's [2]notification letter reads. The insurer is providing the impacted individuals with 12 months of free credit monitoring and identity protection services.
[1] https://www.securityweek.com/insurance-firm-lemonade-says-api-glitch-exposed-some-drivers-license-numbers/
[2] https://www.sec.gov/ix?doc=/Archives/edgar/data/0001691421/000169142125000053/lmnd-20250404.htm
> Insurance firm Lemonade is notifying roughly 190,000 individuals that their driver's license numbers were [1]likely exposed due to a technical glitch . Copies of the notification letter that were submitted to regulators in several states show that the incident involved an online application that enables individuals to obtain car insurance quotes and purchase policies. According to the company, a vulnerability in the car insurance quote flow resulted in the exposure of certain driver's license numbers for identifiable individuals. The vulnerability has been addressed, Lemonade says.
>
> Between April 2023 and September 2024, the platform transmitted the information unencrypted, which the company says allowed driver's license numbers to be accessed without authorization. "We have no evidence to suggest that your driver's license number has been misused but we are providing this notice as a precaution to inform potentially affected individuals and share some steps you can take to help protect yourself," the company's [2]notification letter reads. The insurer is providing the impacted individuals with 12 months of free credit monitoring and identity protection services.
[1] https://www.securityweek.com/insurance-firm-lemonade-says-api-glitch-exposed-some-drivers-license-numbers/
[2] https://www.sec.gov/ix?doc=/Archives/edgar/data/0001691421/000169142125000053/lmnd-20250404.htm
Incompetence (Score:2)
by devslash0 ( 4203435 )
Not a glitch. Stop using the G-word excuse.
When the world hands you lemons ... (Score:2)
> Insurance firm Lemonade
You make an insurance company?
> the platform transmitted the information unencrypted,
Their website touts how fast they process things, maybe not wasting time on en/decrypting probably helps. :-)