Yes, Travelers’ customer information was exposed in multiple data breaches that have resulted in over $17 million in settlements and legal judgments. Between 2020 and the early 2020s, hackers gained unauthorized access to personal identifying information through Travelers’ systems, exposing driver’s license numbers, policy information, and other sensitive data belonging to insurance customers and prospective policyholders. These incidents triggered both federal class action lawsuits and state-level investigations, with New York regulators and federal judges ultimately approving settlements that required Travelers to implement new security measures and pay significant compensation to affected consumers.
The most recent major settlement came in February 2025, when a federal judge in New York approved a $6 million settlement for a proposed class action that alleged Travelers failed to protect personally identifiable information. This settlement concluded litigation that had been pending for several years and established Travelers’ liability for the data exposure. Just months earlier, in November 2024, New York state authorities announced an $11.3 million combined settlement with both Travelers and GEICO for separate breaches that exposed the personal information of 116,000 New York residents, whose data was subsequently used to file fraudulent unemployment claims during the COVID-19 pandemic.
Table of Contents
- What Personal Information Was Exposed in the Travelers Data Breaches?
- How Did Hackers Access Travelers’ Systems and When Did It Happen?
- What Are the Legal Settlements and Court-Approved Claims?
- How Can Affected Customers File Claims for Compensation?
- What Security Improvements Did Regulators Require?
- Insurance Industry Pattern: Why Are Multiple Insurers Affected?
- What Does This Mean for Insurance Customers Going Forward?
- Conclusion
What Personal Information Was Exposed in the Travelers Data Breaches?
The Travelers data breaches exposed several categories of sensitive personal information that criminals could use for identity theft and fraud. According to regulatory findings, hackers obtained driver’s license numbers from insurance quote generation tools—online platforms that Travelers and geico provided for customers and agents to generate insurance quotes. This information alone is dangerous because driver’s license numbers, combined with other publicly available data, can be used to open fraudulent accounts, apply for loans, or file false unemployment claims.
The November 2024 New York settlement specifically documented how personal information stolen from these quote tools was used to file unemployment insurance fraud claims during the COVID-19 pandemic, affecting 116,000 New York residents. Beyond driver’s license numbers, the breaches exposed other personally identifiable information including names, addresses, and potentially policy information that could be used in phishing attacks or to impersonate customers calling insurance companies. Unlike a data breach at a retailer where stolen information might be limited to payment card data, a breach at an insurance company exposes information that is directly tied to someone’s identity, driving history, and financial situation—making it particularly valuable to criminals. The 2022 litigation documents specifically alleged that Travelers’ online quote tool for agents disclosed personal identifying information of prospective customers to cybercriminals, suggesting the breach affected not just existing policyholders but also people who were merely shopping for insurance quotes.
How Did Hackers Access Travelers’ Systems and When Did It Happen?
The breaches occurred through vulnerabilities in Travelers’ public-facing online systems, particularly the insurance quote generation tools that were designed to be accessible to both customers and insurance agents. The initial exposure began in 2020, when hackers first exploited these vulnerabilities to gain access to the quoting systems. Rather than being a single incident, the exposure appears to have been ongoing—criminals had sustained access to these tools over an extended period, allowing them to harvest personal information continuously. This extended timeline is particularly concerning because it suggests Travelers’ security teams did not immediately detect the breach, leaving customer data vulnerable for an unknown period before the company became aware of the problem.
One critical limitation of the settlements and public disclosures is that neither Travelers nor regulators have clearly specified exactly how long the breach went undetected or how many customers were ultimately affected nationwide. The November 2024 settlement quantified 116,000 affected New York residents, but the federal class action settlement in February 2025 did not specify a nationwide victim count. This information gap matters because people who were exposed but live outside New York may not know their information was compromised or that they have a right to file a claim. The regulatory settlement documents required both GEICO and Travelers to implement penetration testing and comprehensive cybersecurity risk assessments, suggesting that their previous security measures were inadequate to detect and prevent this type of attack.
What Are the Legal Settlements and Court-Approved Claims?
The primary legal vehicle for compensation is the $6 million federal settlement approved in February 2025 by Judge Vincent Briccetti in the U.S. District Court for the Southern District of New York. This settlement concluded a proposed class action that had been pending while Travelers fought the allegations. The judge’s final approval means that class members—defined as people whose personal information was exposed in the Travelers data breach—can now file claims to receive compensation from this settlement fund.
The settlement also likely included injunctive relief requiring Travelers to improve its data security practices, though the specific security improvements are detailed more extensively in the New York state settlement. In addition to the federal settlement, the November 2024 New York state settlement totaling $11.3 million (with $1.55 million specifically owed by Travelers and $9.75 million by GEICO) was announced by New York Attorney General and Department of Financial Services leadership. This settlement reflected violations of New York Executive Law, General Business Law, and the NY Cybersecurity Regulation. Importantly, state-level settlements typically include both financial penalties and mandatory operational changes, making them more comprehensive than federal class action settlements which focus primarily on compensation to consumers. The New York settlement specifically required Travelers to review its systems, assess access controls, and improve protections against unauthorized access—concrete operational mandates that the company had to implement.
How Can Affected Customers File Claims for Compensation?
To file a claim in the federal class action settlement, affected individuals must first determine whether they fall within the class definition. Generally, the class includes anyone whose personal identifying information was exposed in the Travelers data breach(es). The settlement administrator will have specific claim instructions available through the settlement website, which typically opens 30 to 60 days after final court approval. Claimants may need to provide proof of exposure, such as documentation showing they had a Travelers insurance quote or policy during the time period when the breach occurred, though settlements often use soft proof standards that accept sworn affidavits if direct documentation is unavailable.
The claim filing process is free and does not require hiring an attorney, though consumers should be cautious about third-party “claim processing” services that charge fees to help file claims. These services typically take 20 to 30 percent of the settlement award, whereas filing directly with the settlement administrator costs nothing. Claim deadlines are strictly enforced—consumers who miss the deadline lose their right to claim compensation entirely. Deadline information will be published on the settlement website and typically appears in court-authorized notice campaigns, but people who discover the breach months or years after the initial exposure may find themselves at risk of missing the deadline. The key tradeoff in settlement administration is between accessibility (long claim windows that help more people) and finality (short windows that allow the settlement fund to distribute money quickly).
What Security Improvements Did Regulators Require?
The New York regulatory settlement imposed specific, measurable security requirements on both Travelers and GEICO that go beyond what a federal class action typically requires. For GEICO, regulators mandated comprehensive penetration testing and cybersecurity risk assessments—essentially requiring the company to pay security firms to actively try to break into their systems and identify vulnerabilities before criminals do. For Travelers specifically, the settlement required the company to review its systems, conduct a thorough assessment of access controls, and implement improvements to protect against unauthorized access. These requirements suggest that Travelers’ previous security posture was reactive rather than proactive, relying on incident response after breaches occurred rather than preventing them.
A limitation of these settlement-mandated improvements is that regulators do not typically disclose the details of what Travelers actually implemented or provide periodic public updates on whether the company is maintaining compliance. The company submits compliance reports to regulators, but these are confidential and not made available to the public. This creates an information asymmetry where Travelers knows how secure its systems are, regulators monitor compliance behind closed doors, but consumers have no independent way to verify that the company has genuinely improved its defenses. Additionally, settlements typically expire after 3 to 5 years, at which point the regulatory requirements sunset unless violations are discovered and new enforcement actions are filed.
Insurance Industry Pattern: Why Are Multiple Insurers Affected?
The Travelers breaches are not isolated incidents within the insurance industry. GEICO, which was subject to the same $11.3 million New York settlement, used similar public-facing quote generation tools that were vulnerable to the same type of attack. This pattern suggests that multiple insurance companies made analogous architectural decisions that prioritized ease of use for customers and agents over layered security controls. Insurance companies’ push to move quote systems online to reduce customer friction and agent workload created a security tradeoff—these systems had to be accessible to anyone with an internet connection, which made them attractive targets for attackers who could probe for vulnerabilities at scale.
The quote tool vulnerability also highlights the broader challenge of API security in financial services. These quote generation tools are essentially APIs (application programming interfaces) that accept customer information as input and return a quote as output. If the API does not properly validate that only authorized requests are being made, attackers can scrape it for personal information or bypass intended restrictions. The fact that both GEICO and Travelers’ quote tools had this vulnerability suggests it may have been an industry-wide blind spot rather than a company-specific oversight. Unlike a payment processor that handles thousands of transactions per day and thus has stronger incentive to monitor for fraud and theft, an insurance quote tool is a lower-visibility system that may not receive the same security attention.
What Does This Mean for Insurance Customers Going Forward?
The settlements and regulatory actions have created incremental pressure on insurance companies to improve data security, but they have not fundamentally changed the industry’s approach to handling customer information. Insurance companies still need to collect extensive personal information to provide accurate quotes and issue policies, and as long as that information exists in their systems, it remains a potential target for theft. The increased regulatory enforcement evident in the New York settlement—with personal fines for executives and mandatory security implementations—may shift incentives somewhat, but it typically takes multiple large enforcement actions to change industry-wide behavior.
For consumers, the lesson is to monitor credit and consider credit monitoring services if their information was exposed in a significant breach like Travelers’. Credit freezes and fraud alerts are free tools offered by credit bureaus (Equifax, Experian, TransUnion) and provide some protection if someone attempts to use your personal information to open an account. However, the fact that stolen insurance information was used to file unemployment fraud claims during COVID-19 suggests criminals are becoming more sophisticated in how they weaponize breached data—using it for less obvious forms of fraud that might not trigger traditional identity theft detection. Travelers and other insurers continue to operate the same quote tools that were breached, protected (in theory) by the security improvements mandated by settlements, but the underlying architectural challenge remains.
Conclusion
Travelers’ data breaches exposed hundreds of thousands of customers’ personal information, including driver’s license numbers and policy data, through vulnerabilities in publicly accessible insurance quote generation tools. The company now faces over $17 million in combined federal and state settlements, with a $6 million federal class action settlement approved in February 2025 and an $11.3 million New York state settlement announced in November 2024. These settlements provide a mechanism for affected customers to claim financial compensation and require Travelers to implement improved security measures, though the regulatory requirements will eventually expire if no further violations are discovered.
If you believe your information was exposed in a Travelers data breach, you should file a claim in the federal settlement as soon as the claim window opens and monitor your credit reports for suspicious activity. Visit the settlement administrator’s website to determine eligibility and claim deadlines, and be cautious about any third-party claim processing services that charge fees. Beyond the settlements, consider using free credit monitoring or credit freezes offered by the major credit bureaus, particularly given the documented use of stolen insurance information for unemployment fraud. The Travelers settlements represent a significant enforcement action, but they underscore the ongoing risk that personal information stored by financial institutions can be breached—making vigilance and proactive credit monitoring essential for consumers.
You Might Also Like
- U-Haul Data Breach Class Action Claims Customer Driver’s License Information Was Exposed
- Oracle Data Breach Litigation Claims Customer Information Was Exposed
- Union Home Mortgage Data Breach Litigation Claims Borrower Information Was Exposed
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: