GEICO

New York's Department of Financial Services notified GEICO of an industry-wide cyberattack campaign to obtain driver's license numbers - and GEICO suffered a series of attacks on its quoting tools starting in November 2020 - first through its public website, then, after it fixed those flaws, through the quoting tool used by its insurance agents. Regulators concluded GEICO never conducted a comprehensive review of its systems despite all of it. About 116,000 New Yorkers were exposed, and the stolen license numbers were used to file fraudulent pandemic unemployment claims in other people's names. GEICO paid $9.75 million in November 2024 - $4.75M to the Attorney General and $5M to DFS. The detail worth sitting with: the exposure ran through GEICO's public-facing and agent quoting tools rather than its customer account systems; the regulators describe those affected only as New York residents, not as GEICO customers.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.hunton.com/privacy-and-cybersecurity-law-blog/ny-ag-and-nydfs-announce-11-3-million-data-breach-settlement-with-geico-and-travelers — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Contacts

Privacy contact. Not verified this pass — recommend a direct follow-up

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. CORPORATE HEADQUARTERS (verified on GEICO's own contact-by-mail page): GEICO, 4608 Willard Avenue, Chevy Chase, MD 20815, USA. CAVEAT: GEICO's published mail page lists departmental addresses (largely HR and regional claims offices) and does NOT name a privacy-specific address; the Chevy Chase HQ is the corporate address, not a confirmed privacy-notice address. Given the $9.75M NY DFS/OAG penalty on this row, confirm the correct service address before sending anything that matters. DMV-local: GEICO is headquartered in Maryland.