Lemonade lemonade.com Lemonade data breach: what happened and what to do
Lemonade, the insurance company, told regulators that a flaw in its online car insurance quote flow exposed driver's license numbers. Its notice letter dates the exposure from about April 2023 to April 8, 2025. Texas and South Carolina filings alone cover about 19,500 people.
View all 13,115 breaches- Breach date
- Apr 2023
- Data exposed
- Driver's licenses
- Last updated
What happened
Lemonade says it learned of a vulnerability on March 14, 2025 that was likely to have exposed driver's license numbers of identifiable people. The flaw sat in the online quote flow for car insurance, where a third-party vendor typically fills in the driver's license number automatically.
The dates differ between sources. Press coverage in April 2025 described an exposure window running from about April 2024 into 2025, while Lemonade's later individual notice letter says it lasted from approximately April 2023 through April 8, 2025. The letters began going out on April 10, 2025.
The company hasn't published a total number of people affected. State filings show about 17,563 people in Texas and 1,950 in South Carolina, and those are only two states.
What was exposed
Driver's license numbers. Lemonade says it has no evidence that any number has been misused.
A license number is a government ID. Criminals use it to open accounts or file claims in your name and to pass identity checks at banks and phone carriers. It also makes a phishing message more believable, as in a text from "your insurer" that quotes part of your license.
The company's response
Lemonade says it fixed the vulnerability and is offering identity protection and credit monitoring. It hasn't explained publicly how the flaw came about. A lawsuit later alleged that the exposure continued for 17 months and that people weren't told for two years. Those are allegations, not findings.
What this means for you
If you requested a Lemonade car insurance quote, check your mail for a notice. A leaked license number is hard to undo, though you can ask your state's DMV about replacing it after identity theft.
What to do if you were in it
- 1
Read the notice and take the monitoring offer
Lemonade's letter explains what applies to you and includes free identity protection and credit monitoring.
- 2
Freeze your credit at all three bureaus
A freeze stops lenders from opening new accounts in your name. It's free and takes a few minutes each at Equifax, Experian and TransUnion. Lift it temporarily when you apply for credit yourself.
- 3
Watch for license-related fraud
Look for DMV notices, insurance policies or loans you didn't apply for. If your license number is misused, report it to the police and ask your state DMV about flagging or replacing it.
- 4
Be careful with messages that quote your details
A text or email that mentions Lemonade or part of your license isn't proof it's real. Contact your insurer through its app or website.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appear in. Serus monitors breach databases and the dark web and alerts you if your details show up again. It can't remove data that has already leaked.
Frequently asked
Was I affected by the Lemonade data breach?
Lemonade mailed notice letters starting April 10, 2025 to the people it identified. If you requested a car insurance quote and got no letter, ask the company.
What data was exposed?
Driver's license numbers, according to Lemonade's notice.
How many people were affected?
Lemonade hasn't published a total. State filings show about 17,563 people in Texas and 1,950 in South Carolina.
Should I change my password?
The exposed data was license numbers, not passwords. Changing your password isn't needed for this breach, but a credit freeze is worth doing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
