HackingCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTHighResolved
Aon
bd_bdef13158191852d · schema v1 · pii pii-v1
Full breach record for Aon →Aon Plc, a financial services company, reported an external system breach that affected 31,799 individuals. The incident occurred between December 29, 2020, and March 1, 2022, and was discovered on February 25, 2022. The compromised data included names combined with driver's license or non-driver identification card numbers. Aon provided affected individuals with written notification and offered 24 months of complimentary identity theft protection and credit monitoring services.
Maine clockDiscovered Feb 25, 2022 → Filed with AG May 26, 202290d ⏱ ME AG >30d13 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_d4e9fb69d737f7a6Leak Sitedispossessorfiled 2022-07-03(38d gap)Verified
Regulatory filings (5) · sorted by filing gap
- bd_a34b45e6fa897e08Oregon State AGfiled 2022-05-26Verified
- bd_a3a4b3bd3ddac8fcCalifornia State AGfiled 2022-05-26Verified
- bd_bf4952e393f83732Washington State AGfiled 2022-05-26Verified
- bd_ee7cfc9886fcd713Maine State AGfiled 2022-06-24(29d gap)Candidate
Show 1 more filing ↓Show fewer ↑up to 36d gap
- bd_83344b1fed7fdb7aMaine State AGfiled 2022-07-01(36d gap)Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/dbaf41f7-1996-448f-bf43-1de58b4b634b.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 26, 2022
- Raw hash
- 8e5c5d8622d1522f92cf6fc23cdff261c54e65cab79b81196cc401bdf2d76fd9
Reporting entity
- Name
- Aonnorm: aon
- Domain
- aon.com
Victim entity
- Name
- Aonnorm: aon
- Domain
- aon.com
Incident
- Discovered
- Feb 25, 2022
- Materiality determined
- —
- Notification sent
- May 27, 2022
- Affected individuals
- 31,799
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- Threat actor
- External
Compliance
- Time to disclose
- 13 weeks(90 days from discovery to filing)
- Compliance flags
- ME AG >30d · 90dME resident >60d · 91d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 25, 2022→ Filed with AG: May 26, 202290d 30 days (soft) ME AG >30d Maine Discovered: Feb 25, 2022→ Notified: May 27, 202291d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.