Details were collected over 17 months.
Insurance firm Lemonade has confirmed the compromise of thousands of individuals' driver's license numbers.
Collected between April 2023 and September 2024 following the exploitation of an online application platform vulnerability. Lemonade said it discovered the issue in March 2025, but has not provided additional details regarding the extent of the incident, which has already been remediated after its discovery last month.
Lemonade said it has taken steps to fix the vulnerability but did not respond to requests for comment from The Record about how it did so, how many people were affected or how it was initially tipped off to the problem.
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
