Hippo says a coding error in its online quote tool may have exposed people’s names, dates of birth and driver’s license numbers from January 30, 2025 to August 11, 2026. It reported the breach to the Texas Attorney General and Massachusetts regulators on Oct. 30, 2026.

Attackers sent requests straight to the tool’s prefill feature, which pulls consumer data from Verisk to speed up quotes. Because of the error, the responses could include driver’s license numbers. Hippo said it never meant to collect those through the feature.

Hippo couldn’t confirm whether attackers got the data or which records they reached. So far, 38,518 Texas residents and 5,132 Massachusetts residents have been identified as potentially affected, and Hippo has started notifying them by letter. Even people who never asked Hippo for a quote may be affected.

Hippo has removed the feature and is adding CAPTCHA to its quote forms. It is also looking at stronger API security, request limits and monitoring. Affected people are being offered identity protection and credit monitoring.