HackingDelayed DiscoveryCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTCriticalContained
Aon
bd_83344b1fed7fdb7a · schema v1 · pii pii-v1
Full breach record for Aon →Aon Plc experienced a prolonged external system breach, lasting from December 29, 2020, to March 1, 2022. The incident was discovered on February 25, 2022. It affected 153,784 individuals, compromising names combined with driver's license or non-driver identification card numbers. In response, Aon offered 24 months of identity theft protection and credit monitoring services from Experian.
Maine clockDiscovered Feb 25, 2022 → Filed with AG Jul 1, 2022126d ✗ ME AG >90d18 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_d4e9fb69d737f7a6Leak Sitedispossessorfiled 2022-07-03(2d gap)Verified
Regulatory filings (5) · sorted by filing gap
- bd_ee7cfc9886fcd713Maine State AGfiled 2022-06-24(7d gap)Candidate
- bd_a34b45e6fa897e08Oregon State AGfiled 2022-05-26(36d gap)Verified
- bd_a3a4b3bd3ddac8fcCalifornia State AGfiled 2022-05-26(36d gap)Verified
- bd_bdef13158191852dMaine State AGfiled 2022-05-26(36d gap)Candidate
Show 1 more filing ↓Show fewer ↑up to 36d gap
- bd_bf4952e393f83732Washington State AGfiled 2022-05-26(36d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f16e07cb-f3ce-4bad-af8e-0c7fcadb5dd3.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 1, 2022
- Raw hash
- c42e86a2971faa33462d7ec2fe81c098f89d54837e081f2e43c51badbd2d5eca
Reporting entity
- Name
- Aonnorm: aon
- Domain
- aon.com
Victim entity
- Name
- Aonnorm: aon
- Domain
- aon.com
Incident
- Discovered
- Feb 25, 2022
- Materiality determined
- —
- Notification sent
- May 27, 2022
- Affected individuals
- 153,784
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- Threat actor
- External
Compliance
- Time to disclose
- 18 weeks(126 days from discovery to filing)
- Compliance flags
- ME AG >90d · 126dME resident >60d · 91d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 25, 2022→ Filed with AG: Jul 1, 2022126d 90 days ME AG >90d Maine Discovered: Feb 25, 2022→ Notified: May 27, 202291d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.