MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)CredentialsFinancial accountPHIHealth (basic)BiometricEmploymentMediumContained

ARTHUR J. GALLAGHER & CO.

bd_cbd9465155c75b1c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 26, 2020

Filed

Jun 30, 2021

To disclose

40 weeks

Affected

Not disclosed

Linked

30 filings

Confidence

64%

Full breach record for ARTHUR J. GALLAGHER & CO. →31 incidents on file

Arthur J. Gallagher & Co. detected a ransomware event on September 26, 2020, impacting internal systems. An unknown party accessed data between June 3, 2020, and September 26, 2020. Affected data may include SSNs, driver's licenses, financial account info, medical information, and biometric data. The company took systems offline, engaged forensic specialists, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 26, 2020 → Notified Jun 30, 2021277d ✗ CA 60-day late40 weeks discovery → filing

Incident timeline

undetected · 115 days

discovery → filing · 40 weeks / 277 days

Jun 3, 2020

Begins

Sep 26, 2020

Discovered

Jun 30, 2021

Filed

vs. sector median

+22 wks slower

This filing is one of 30 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

South Carolina State AGbd_46c22c0e135074c12021-08-17 · +48dVerified
Delaware State AGbd_4802bf691a0b05cf2021-08-17 · +48dVerified
South Carolina State AGbd_5a60d99cfc68d2f62021-08-17 · +48dVerified
Delaware State AGbd_d559ecce5b3385332021-08-19 · +50dVerified

Show 6 more filings ↓up to 96d gap

New Hampshire State AGbd_7a32a3fe8539d6192021-08-23 · +54dVerified
New Hampshire State AGbd_e05a56a536c799dd2021-09-07 · +69dVerified
South Carolina State AGbd_e1bf416a552091df2021-09-08 · +70dVerified
New Hampshire State AGbd_128a2682206fdf792021-09-13 · +75dVerified
South Carolina State AGbd_97dcb7179082a9e82021-09-30 · +92dVerified
New Hampshire State AGbd_544b44357c05bc6c2021-10-04 · +96dVerified

Showing first 10 of 29 linked disclosures.

Name: ARTHUR J. GALLAGHER & CO.
norm: arthur j gallagher

Name: ARTHUR J. GALLAGHER & CO.
norm: arthur j gallagher
Industry: Professional Servicesllm

Discovered: Sep 26, 2020
Breach occurred: Jun 3, 2020 – Sep 26, 2020
Undetected for: 115 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 30, 2021
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)CredentialsFinancial accountPHIHealth (basic)BiometricEmployment
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Reported this incident to law enforcement and regulatory authorities, as required by law

During the incident: Took systems offline as a precautionary measure
Initiated response protocols
Notified law enforcement
Launched an investigation with the assistance of third-party cybersecurity and forensic specialists
Implemented business continuity plans to minimize disruption to customers
Ensured the ongoing security of systems
Conducted an extensive review of the entire contents of the impacted systems
Provided access to identity and credit monitoring services for twenty-four (24) months through Kroll
Changes made: Reviewed existing security policies
Implemented additional measures and enhanced security tools to further protect information in systems
Implemented additional safeguards
Provided additional training to employees on data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 40 weeks(277 days from discovery to filing)
Compliance flags: CA 60-day late · 277d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 26, 2020
→ Notified: Jun 30, 2021
277d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 26, 2020 → Notified: Jun 30, 2021	277d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

California State AGJun 30 · first · this page

South Carolina State AG+48d

Delaware State AG+48d

South Carolina State AG+48d

Delaware State AG+50d

New Hampshire State AG+54d

New Hampshire State AG+69d

South Carolina State AG+70d

New Hampshire State AG+75d

South Carolina State AG+92d

New Hampshire State AG+96d

Pattern: first filing Jun 30 (CA), last Oct 4 (NH) — a 96-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 29 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-542441
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 30, 2021
Raw hash: 2ffb797f4055f4a2ce72c5ae3f1a8070ddbcd7db135583784d298a0d0766de05

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityARTHUR J. GALLAGHER & CO.

Victim entityARTHUR J. GALLAGHER & CO.

Incidentdiscovered Sep 26, 2020

Stated responseTook systems offline as a precautionary measure

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov