---
title: "Hippo insurance quote-tool data exposure"
description: "Hippo Analytics identified suspicious use of its auto-insurance quote tool on August 3, 2026. Unidentified actors submitted information and may have viewed personal data returned by the prefill feature."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-05"
canonical_url: "https://www.ally.security/incidents/hippo-insurance-quote-tool-data-exposure-2025"
markdown_url: "https://www.ally.security/incidents/hippo-insurance-quote-tool-data-exposure-2025.md"
stix_url: "https://www.ally.security/incidents/hippo-insurance-quote-tool-data-exposure-2025/stix.json"
---

# Hippo insurance quote-tool data exposure

Hippo Analytics identified suspicious use of its auto-insurance quote tool on August 3, 2026. Unidentified actors submitted information and may have viewed personal data returned by the prefill feature.

Last modified Nov 5, 2026 · 1 source

## Summary

- **Environment:** Online auto-insurance quote prefill tool
- **Operational impact:** Names and driver’s license numbers potentially accessed
- **Financial impact:** No incident cost publicly quantified

## What happened

[Hippo Analytics](https://www.hippo.com/) identified suspicious use of its auto-insurance quote tool on August 3, 2026. Unidentified actors submitted information and may have viewed personal data returned by the prefill feature. [1](#source-1)

## Impact

The California notice identifies names and driver’s license numbers as potentially accessed. People without a relationship with Hippo could also be affected. [1](#source-1)

## Timeline

### August 3, 2026 — Suspicious quote-tool activity detected

Suspicious quote-tool activity detected, as described in the [incident notice](https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf). [1](#source-1)

### August 11, 2026 — Issue fully remediated

Issue fully remediated, as described in the [incident notice](https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf). [1](#source-1)

### October 30, 2026 — Notification letter dated

Notification letter dated, as described in the [incident notice](https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf). [1](#source-1)

### November 5, 2026 — Briefing updated

This briefing was last reviewed and updated on November 5, 2026.

## Threat Group & Attack Vector

The investigation placed unauthorized activity between January 30, 2025, and August 11, 2026, when Hippo said the issue was fully remediated. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Hippo removed the affected public-facing functionality, deployed code changes and added controls. Its October 30 letter offered 12 months of identity protection. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/hippo-insurance-quote-tool-data-exposure-2025/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Hippo Analytics notice of data breach

official · Hippo Analytics · Oct 30, 2026

<https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Discovered At · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: 2026-08-03
2. **Occurred At · 100% confidence · current**  
   Notification letter dated: 2026-10-30
3. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: Notification letter dated
4. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: Hippo Analytics identified suspicious use of its auto-insurance quote tool on August 3, 2026. Unidentified actors submitted information and may have viewed personal data returned by the prefill feature.
5. **Occurred At · 100% confidence · current**  
   Suspicious quote-tool activity detected: 2026-08-03
6. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: Issue fully remediated
7. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: The investigation placed unauthorized activity between January 30, 2025, and August 11, 2026, when Hippo said the issue was fully remediated.
8. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: The California notice identifies names and driver’s license numbers as potentially accessed. People without a relationship with Hippo could also be affected.
9. **Affected Organization · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: Hippo Analytics
10. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: Suspicious quote-tool activity detected
11. **Occurred At · 100% confidence · current**  
   Issue fully remediated: 2026-08-11
12. **Resulted In · 100% confidence · current**  
   Hippo insurance quote-tool data exposure: Hippo removed the affected public-facing functionality, deployed code changes and added controls. Its October 30 letter offered 12 months of identity protection.

</details>