HackingOtherStolen CredentialsCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Health (basic)LowContained

Samaritan

bd_2560c64a4edf156e · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 15, 2025

Filed

Mar 28, 2025

To disclose

6 weeks

Affected

13state residents only

Linked

3 filings

Confidence

65%

Full breach record for Samaritan →2 incidents on file

Samaritan's Purse notified Washington AG that vendor Lockton Companies LLC experienced unauthorized access to a user account on Nov 20, 2024. Files containing employee and dependent PII (name, DOB, job title, benefits info) were accessed. No SSNs or credit cards were involved. Lockton contained the incident and offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

Incident timeline

undetected · 87 days

discovery → filing · 6 weeks / 41 days

Nov 20, 2024

Begins

Feb 15, 2025

Discovered

Mar 28, 2025

Filed

vs. sector median

on median

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_0488551b1ba0a20a2025-03-28Verified
Illinois State AGbd_758facb9b6b6f69c2025-04-01 · +4dCandidate

Name: Samaritan
norm: samaritan
Domain: samaritanspurse.org

Name: Samaritan
norm: samaritan
Domain: samaritanspurse.org
Industry: Otherllm

Discovered: Feb 15, 2025
Breach occurred: Nov 20, 2024
Undetected for: 87 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 28, 2025
Affected individuals: 13state-resident count only
Data types: Identity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Engaged third-party cybersecurity experts
Notified law enforcement
Contained the incident
Conducted a robust review of the files to identify impacted individuals
Offered complimentary 24-month membership in Experian IdentityWorks
Changes made: Lockton implemented additional security protocols designed to enhance the security of their network, internal systems and applications
Reviewed contract with the vendor
Reviewed process for sharing personal information with brokers and consultants
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRMar 28 · first

Washington State AGMar 28 · first · this page

Illinois State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA32866.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2025
Raw hash: 1ead75bb99e76b171efe6ebd52c8f7583be2c13508919f8630e95052ad79a2bf

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySamaritan

Victim entitySamaritan

Incidentdiscovered Feb 15, 2025

Stated responseEngaged third-party cybersecurity experts

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com