Geico Discloses Driver’s License Information Class Action

Data breaches are becoming an all-too-familiar story among companies that store personal identifying information (PII). This class action brings suit against Government Employees Insurance Company (GEICO), Geico Casualty Company, Geico Indemnity Company, and Geico General Insurance Company, as well as parent company Berkshire Hathaway, Inc., alleging that the companies failed to safeguard customer PII.

The Nationwide Class for this action is all individuals living in the US whose PII was compromised as a result of the Data Disclosure initially revealed by Geico on around April 9, 2020.

Geico is known as an auto insurance company, one of the largest in the country. The complaint alleges it has some 17 million policyholders.

Around April 9, 2021, Geico issued a Notice of Data Disclosure that revealed that between November 24, 2020 and March 1, 2021, Geico’s website had permitted unauthorized persons to access the driver’s license information of policyholders. Geico noted that the information, including information on the licenses, could be used to fraudulently apply for unemployment benefits in the policyholders’ names.

That’s not all, the complaint claims: “The confidential information that Geico revealed in the Data Disclosure can be used to gain unlawful access to the users’ home addresses, legal names, and other online accounts. It can also be used to carry out identity theft or commit other fraud. And[] it can be sold to those who broker and traffic in stolen PII and be disseminated on the [I]nternet.”

The complaint quotes CPO Magazine as saying, “To those unfamiliar with the world of fraud, driver’s license number might seem like a relatively harmless piece of information to lose if it happens in isolation.” This is not true, the magazine says, because the numbers can be used to make fake IDs, can be put into any form that requires ID verification, and can be used to create scam e-mail that look like it’s from the DMV, asking the driver to verify other personal information, with or without a malicious link or attachment.

The complaint alleges that driver’s license numbers have previously been stolen from insurance provided, so that Geico should have been alerted to the need to take measures to protect customers’ information. The complaint alleges, “The Data Disclosure could have been avoided through basic security measures, authentications, and training.”

Although Geico promised to safeguard information entrusted to it, the complaint says that the companies “failed to take reasonable steps to adequately protect the PII of Geico’s current and former policyholders. The Data Disclosure was a direct result of [the companies’] failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect PII.”

The counts include negligence, breach of contract, and breach of the Drivers Privacy Protection Act, among other things.

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy