Lemonade, Inc. was the subject of a data breach notification filed with the CA Attorney General. The AG filing was recorded on June 12, 2025. The breach or discovery date reported in the filing is April 8, 2025.
Data Exposed
Lemonade, Inc. was the subject of a data breach notification filed with the CA Attorney General. The AG filing was recorded on June 12, 2025. The breach or discovery date reported in the filing is April 8, 2025.
Lemonade, Inc. operates as a prominent digital-first insurance company that utilizes artificial intelligence and behavioral economics to provide homeowners, renters, pet, car, and term life insurance products. Because of its technology-driven business model, the company interacts with millions of customers entirely online and through mobile applications, collecting massive volumes of deeply personal, financial, and transactional information. To underwrite policies, process premium payments, and handle insurance claims efficiently, Lemonade routinely gathers and stores sensitive records that make it a prime target for cybercriminals seeking high-value consumer data. In 2025, Lemonade reported a significant cybersecurity incident to the California Attorney General, bringing to light a data security compromise that threatened the private information of its policyholders. While the exact vector of the attack continues to be scrutinized, security incidents affecting digital insurance platforms typically involve unauthorized intrusions into cloud-hosted databases, vulnerabilities within third-party vendor integrations, or credential stuffing attacks that bypass authentication barriers. For an automated insurer like Lemonade, an unauthorized network intrusion can compromise the core infrastructure where customer intake forms, policy applications, and internal communications are stored. Data breach notification letters sent by insurance companies typically reveal the exposure of high-risk identifiers, including full names, dates of birth, Social Security numbers, driver's license numbers, and detailed financial account or credit card information. In the context of the insurance sector, exposure of policy numbers, claims history, and underwriting documentation creates severe, multi-faceted risks for victims. Cybercriminals can leverage Social Security numbers and dates of birth to perpetrate comprehensive identity theft, open fraudulent lines of credit, or file unauthorized tax returns, while compromised financial and policy details can be weaponized to execute targeted financial fraud and sophisticated phishing schemes. As a financial services and insurance provider operating in California, Lemonade, Inc. is bound by stringent legal obligations under state and federal frameworks, including the California Consumer Privacy Act (CCPA) and California's data breach notification statute, alongside industry-specific regulations governing the secure handling of consumer financial records. These laws require companies to implement reasonable security procedures and practices appropriate to the nature of the personal information retained. The occurrence of a widespread data breach strongly suggests a failure in these mandatory administrative, technical, and physical safeguards, potentially exposing the company to significant liability for failing to protect consumer privacy. For consumers who received a data breach notification letter from Lemonade, Inc., the notice serves as formal acknowledgment that their private information was compromised due to corporate negligence. Legally, receipt of this letter establishes standing to participate in a class action lawsuit aimed at holding the company accountable for its security lapses. Affected individuals do not need to prove that they have already suffered actual financial loss to seek legal remedies, as the increased risk of future identity theft and the time and expense required to monitor credit are recognized harms. Our firm investigates these cases on a strict contingency fee basis, meaning affected policyholders pay nothing out of pocket and our attorneys are only compensated if we successfully recover compensation on your behalf.
Based on the data types reported, affected individuals face:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
What the California Consumer Privacy Act (CCPA) and federal statutes entitle you to recover:
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under California Consumer Privacy Act (CCPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from Lemonade, Inc. does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by Lemonade, Inc. during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Received a notification letter from Lemonade, Inc.?
What it means and what to do next.
Lemonade, Inc. breach?
Free case review · No fee unless you win