Travelers Insurance

Travelers was breached through the auto-insurance quoting calculator its independent agents use - a portal that did not have multi-factor authentication switched on, despite Travelers having received multiple industry alerts warning that attackers were targeting exactly these tools. It did not detect the intrusion for more than seven months, only beginning to investigate in November 2021, and by then hackers had taken the driver's license numbers of approximately 4,000 New Yorkers (DFS's consent order gives no nationwide count of license numbers, but says the attacker accessed approximately 40,000 household driver reports containing them and that Travelers notified several tens of thousands of consumers), which were used to file fraudulent pandemic unemployment claims in those people's names. New York regulators fined Travelers $1.55 million in November 2024. The structural point matches the GEICO finding in the Insurance tab: the exposure sat in the quoting tool, so people who merely priced a policy through an agent were swept in alongside actual customers.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.hunton.com/privacy-and-cybersecurity-law-blog/ny-ag-and-nydfs-announce-11-3-million-data-breach-settlement-with-geico-and-travelers — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual policyholder agreements, separate from this specific completed settlement.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (TRV). Service route: c/o General Counsel / Corporate Secretary, New York, New York — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.