HackingGovernmentGovernmentSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)MediumActive

City of Marion

bd_68b35b4e3eb4b729 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Aug 3, 2026

Filed

Aug 21, 2026

To disclose

18 days

Affected

500scope not determined

Confidence

68%

Full breach record for City of Marion →

City of Marion, Iowa, notified the Iowa Attorney General via counsel (Lynch Dallas Legal) on August 21, 2026, of a security breach involving its former group health insurance broker, PDCM Insurance. The breach impacted more than 500 current and former employees, exposing names, Social Security numbers, and dates of birth. PDCM notified the AG on August 3, 2026. The City is working with PDCM to notify affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 18 days

Aug 3, 2026

Discovered

Aug 21, 2026

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed500 affectedView incident

Name: Lynch Dallas Legal
norm: lynch dallas legal

Name: City of Marion
norm: city of marion
Industry: Governmentllm

Discovered: Aug 3, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 500scope not determined
Data types: Government IDIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Notified Iowa Attorney General Data Protection Division
Third party: via PDCM Insurance
Initial access: supply_chain

During the incident: Working closely with the City of Marion and PDCM to inform affected individuals
PDCM has already notified the Data Protection Division
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.iowaattorneygeneral.gov/media/cms/8212026_City_of_Marion_Iowa_710B145A71105.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2026
Raw hash: b998edb057d5cf7b407db47e22a20d935b584707aebfebd120318450445201c4

Reporting entityLynch Dallas Legal

Victim entityCity of Marion

Incidentdiscovered Aug 3, 2026

Stated responseWorking closely with the City of Marion and PDCM to inform affected individuals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.iowaattorneygeneral.gov