Summary
- Environment: Online auto-insurance quote prefill tool
- Operational impact: Names and driver’s license numbers potentially accessed
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 5, 2026; updated as evidence emerges.
What happened
Hippo Analytics identified suspicious use of its auto-insurance quote tool on August 3, 2026. Unidentified actors submitted information and may have viewed personal data returned by the prefill feature. [1]
Impact
The California notice identifies names and driver’s license numbers as potentially accessed. People without a relationship with Hippo could also be affected. [1]
Timeline
Suspicious quote-tool activity detected
Suspicious quote-tool activity detected, as described in the incident notice.
[1]Issue fully remediated
Issue fully remediated, as described in the incident notice.
[1]Notification letter dated
Notification letter dated, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 5, 2026.
Threat Group & Attack Vector
The investigation placed unauthorized activity between January 30, 2025, and August 11, 2026, when Hippo said the issue was fully remediated. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Hippo removed the affected public-facing functionality, deployed code changes and added controls. Its October 30 letter offered 12 months of identity protection. [1]