HackingProfessional ServicesProfessional ServicesSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)EmploymentEducationMediumActive

MARSH & MCLENNAN COMPANIES, INC.

bd_d1c97559aca93f13 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 25, 2013

Filed

Nov 26, 2013

To disclose

9 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

64%

Full breach record for MARSH & MCLENNAN COMPANIES, INC. →7 incidents on file

Marsh & McLennan Companies notified California residents that Kroll Background Screening Services, a third-party vendor, experienced a data intrusion from June to September 2013. Personal information including SSNs, names, addresses, employment, and academic histories may have been accessed. Kroll notified MMC on September 25, 2013. MMC offered two years of identity protection via AllClear ID and notified regulators and credit bureaus. Investigation was ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 116 days

discovery → filing · 9 weeks / 62 days

Jun 1, 2013

Begins

Sep 25, 2013

Discovered

Nov 26, 2013

Filed

vs. sector median

10 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_bb683b5e87ecdc632013-11-26Verified
Massachusetts State AGbd_2b2299354c2eeccb2013-11-27 · +1dVerified
California State AGbd_4e8cd52ff7211abb2013-11-21 · +5dCandidate
New Hampshire State AGbd_92d69016493a2df92013-11-20 · +6dVerified

Name: MARSH & MCLENNAN COMPANIES, INC.
norm: marsh mclennan companies

Name: MARSH & MCLENNAN COMPANIES, INC.
norm: marsh mclennan companies
Industry: Professional Servicesllm

Discovered: Sep 25, 2013
Breach occurred: Jun 1, 2013 – Sep 15, 2013
Undetected for: 116 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)EmploymentEducation
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified state regulators and law enforcement officials
Third party: via Kroll Background Screening Services
Initial access: supply_chain

During the incident: Notified state regulators and law enforcement officials
Notified the three national consumer reporting agencies
Arranged for AllClear ID to provide identity protection services at no cost
Changes made: Offering two years of complimentary identity protection services through AllClear ID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

New Hampshire State AGNov 20 · first

California State AG+1d

New Hampshire State AG+6d

California State AG+6d · this page

Massachusetts State AG+7d

Pattern: first filing Nov 20 (NH), last Nov 27 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-43389
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2013
Raw hash: dcb7d5e521ba87bfc401b99a702217f271d47eb53141c926bd90988c251e60d7

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMARSH & MCLENNAN COMPANIES, INC.

Victim entityMARSH & MCLENNAN COMPANIES, INC.

Incidentdiscovered Sep 25, 2013

Stated responseNotified state regulators and law enforcement officials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov