Hippo Analytics data breach: a quote tool exposed driver's license numbers for 18 months, 176,128 people

When did the Hippo quote tool exposure start and end?

Hippo says it spotted suspicious activity in the quote tool on August 3, 2026, then investigated and secured its systems. Outside cybersecurity experts helped it trace the activity to the tool being abused by people it could not identify.

The investigation found that the outsiders submitted information through the quote tool. In return, they may have been shown personal information that the tool's pre-fill feature looked up. The California Attorney General's record gives January 30, 2025 as the breach date, the first day of that window. Hippo says the issue was fully fixed on August 11, 2026, eight days after it noticed the activity. Its letters are dated 80 days after the fix and 88 days after it first noticed the activity.

Step	Date (per the notice)
Quote tool abuse window opens	January 30, 2025
Hippo identifies suspicious activity	August 3, 2026
Issue fully remediated	August 11, 2026
Letter dated	October 30, 2026
Filed with California's attorney general	November 3, 2026
Last day to enroll in IDX protection	January 30, 2027

The same pattern appears in an earlier filing on this site. American Family Connect Insurance told California's attorney general in September 2026 that a third party may have obtained driver's license numbers while generating quotes in its online auto insurance quoting process. How long companies take to send these letters compares the gap between detection and notice across the site's record.

What information was exposed in the Hippo breach?

The letter names two items: the recipient's name and driver's license number. It does not list Social Security numbers, financial account numbers or policy details.

Why did someone with no Hippo policy get this letter?

A quote tool that pre-fills a form looks up data about the person whose details are typed in, whether or not that person ever asked Hippo for a quote. That is why the letter tells readers they may be affected even with no relationship with Hippo. Why you got a breach letter from a company you never dealt with covers the other ways this happens in the site's record: vendors, contractors and firms holding data for someone else.

What does Hippo offer, and when is the enrollment deadline?

Hippo says it removed the affected feature from its outward-facing application, deployed further code updates to fully fix the issue, and added stronger technical controls against a repeat.

Recipients are offered IDX identity protection: 12 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and fully managed identity theft recovery. The enrollment deadline is January 30, 2027. IDX's line, 1-866-200-0957, is staffed Monday through Friday from 9 am to 9 pm Eastern Time. The monitoring only works once it is activated, and it needs an established credit file.

The letter also explains how to place a free security freeze with Equifax, Experian and TransUnion, or a one-year fraud alert through any one of them. Credit monitoring offers in breach notice letters compares what other companies on this site offer.

What Texas's attorney general recorded

Texas's attorney general lists a report from Hippo Analytics Inc., published on its website on October 30, 2026, with 38,518 Texans affected. That figure counts Texas residents only; the public list gives no national total.

What Indiana's attorney general recorded

Indiana's attorney general lists Hippo Analytics Inc in its 2026 breach report, with notice sent on October 30, 2026 for a breach that occurred on January 30, 2025: 2,098 Indiana residents and 176,128 people affected in total. The total is the figure the organization reported to Indiana.

What Massachusetts recorded

Massachusetts' Office of Consumer Affairs and Business Regulation lists a report from Hippo Analytics Inc. dated October 29, 2026 (breach 2026-1900): 5,132 Massachusetts residents affected. The categories it marks as breached are driver's license numbers only. The report date sits next to the October 30, 2026 notice date that Indiana and Texas record, which ties this row to the same incident. That count covers Massachusetts residents only.

What the notice leaves open

Hippo says that so far there is no evidence the information was misused. The filed copy is a template for California residents and gives no count of people affected. The counts on record are Texas's and Indiana's, above; Indiana's 176,128 is the total Hippo reported to that state. It does not say how the outsiders got the details they typed into the tool, how many lookups they ran, or what first flagged the activity on August 3, 2026. The Washington attorney general's breach list, checked on November 6, 2026, has no Hippo entry.