Elephant Insurance Exposure of Driver’s License Numbers Class Action

Yet another data breach is the subject of this class action. It claims that Elephant Insurance Company, Elephant Insurance Services, LLC, and Apparent Insurance did not implement adequate security measures to safeguard the personal information (PI), including driver’s license numbers, that they held on file, resulting in a data breach in 2022.

The Nationwide Class for this action is all persons in the US whose personal information was compromised in the unauthorized data disclosure announced by the defendants in this case on or around May 6, 2022. Texas and Illinois Subclasses have also been defined, for those in the above class in Texas or Illinois, respectively.

The defendants in this case provide auto insurance to consumers and therefore keep on file driver’s license numbers for their insureds.

Driver’s licenses are particularly valuable to hackers, the complaint alleges: “In fact, a driver’s license is a critical part of a fraudulent, synthetic identity that can be sold on the dark web and is a jackpot for thieves…” the complaint alleges. Driver’s licenses “can be used to create fake driver’s license or other fake IDs, open fraudulent accounts, avoid traffic tickets or collect government benefits such as unemployment checks, and … for verification on any government form that requires identity verification.”

The complaint points to the theft of driver’s license numbers in 2021 from other insurance providers, such as Geico, Farmers, and American Family. The complaint claims that this “indicat[es] both that this particular form of PI is in high demand and also that sophisticated insurance companies like Defendants knew or had reason to know that they security practices were of particular importance to safeguard consumer data.”

The companies thus had plenty of warning about the likelihood of data breaches, the complaint alleges, especially “given that the New York State Department of Financial Services issued an industry letter on February 16, 2021, stating that they had recently learned of a systemic and aggressive campaign to exploit cybersecurity flaws in public-facing websites to steal the exact kind of information stolen here, and to flag that such information was being used to submit fraudulent claims for pandemic and unemployment benefits.”

Nevertheless, the companies failed to protect the driver’s license numbers and other information they held in their systems, leading to a data breach between at least March 26, 2022 and April 1, 2022. The complaint alleges that Elephant reported this to the public beginning May 6, 2022, and to regulators beginning May 26, 2022. Reportedly, unauthorized persons were able to access names, driver’s license numbers, and dates of birth for more than 2,700,000 people.

The complaint faults Elephant for both its negligence and for its belated announcements: “Elephant also states that it discovered the breach on April 25, 2022, yet waited to [sic] weeks to issue a statement and more than a month to provide actual notice to affected individuals.”

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy