Hippo Analytics Data Breach Impacts 40,000+ Individuals

Hippo Analytics Inc., a technology-focused insurance agency that does business as Hippo Insurance Services, disclosed a data breach tied to a vulnerability in an online tool that pulled data from a third-party service provider, Verisk.

Hippo Analytics operates a public-facing website with an online quote tool that allows users to obtain insurance quotes by entering basic personal informationification. The tool used a "pre-fill" feature that automatically retrieved additional consumer data from Verisk to verify information and improve the accuracy of automated quotes.

The forensic investigation concluded on Oct. 9, 2026. The company's forensic investigation found that threat actors, operating through a commercial residential proxy network, were able to submit requests directly to Hippo's pre-fill API. By doing so, the threat actors could potentially receive enriched data back from the third-party service provider.

The vulnerability at the root of this breach traced back to a coding error in the design of the pre-fill auto quoting tool. The error enabled the optional inclusion of driver's license number fields in the tool's responses.

Because the pre-fill tool could return information about any individual whose data was available from the third-party service provider, it is possible the breach affected people who never interacted with Hippo or requested an insurance quote.

The unauthorized activity began on or about Jan. 30, 2025, and continued until the company fully remediated the issue on Aug. 11, 2026.

The types of personal information potentially exposed included names, driver's license numbers and dates of birth.

The breach was reported to the Texas Attorney General and the Massachusetts Office of Consumer Affairs and Business Regulation on Oct. 30, 2026. So far, 38,518 Texas residents and 5,132 Massachusetts residents were identified as potentially affected. Hippo Analytics began notifying affected consumers by written notice.

Hippo Analytics' response to the breach

Hippo is notifying all residents whose information may have been returned during the period of unauthorized activity.

The company is offering 12 months of complimentary identity protection and credit monitoring services to affected individuals, or 24 months where required by state law.