Vertafore Insurance Technology Platform Breach (2020): 47 Million Texas Driver & Vehicle Records Including Home Address Exposed

About Vertafore

Vertafore is a Denver-based insurance technology company providing software platforms and data services to insurance agents, carriers, and managing general agents. Its products cover agency management, rating, compliance, and distribution workflows across the U.S. property and casualty insurance market. The company is privately held and serves thousands of insurance organizations across the country.

Why They Hold Your Data

Insurance SaaS platforms collect agent, client, policy, claims, contact, and workflow data across software systems used by carriers, brokers, and agencies.

Recent Developments

Vertafore continues to operate as a major insurance technology provider. No significant organizational or ownership changes have been prominently reported in the most recent period. The company has been acquired and managed by private equity through its recent history.

Data Points Exposed

Breach Impact

Between March 11 and August 1, 2020, unauthorized parties accessed three files stored on an unsecured external server containing driver information for approximately 27.7 million Texas residents holding licenses issued before February 2019. The exposed data included names, driver's license numbers, dates of birth, addresses, and vehicle registration histories. Vertafore disclosed the breach in November 2020, reported it to the Texas Attorney General, Texas Department of Public Safety, Texas DMV, and federal law enforcement, and offered one year of free credit monitoring to affected individuals. Multiple class-action lawsuits were filed seeking over $69 billion in statutory damages under the federal Driver's Privacy Protection Act. The litigation ultimately failed at both the district court and Fifth Circuit levels, with courts finding that inadvertent unsecured storage did not constitute a knowing disclosure under the DPPA. The dismissals established a notable precedent limiting DPPA class action exposure for accidental cloud misconfigurations.

Exploitation & Downstream Threats

• Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).