HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)MediumContained

Southeast Series of Lockton Companies, LLC (Lockton)

bd_e6327a5b12a7f224 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 20, 2024

Filed

May 23, 2025

To disclose

26 weeks

Affected

3,268state residents only

Linked

24 filings

Confidence

66%

Full breach record for Southeast Series of Lockton Companies, LLC (Lockton) →3 incidents on file

Southeast Series of Lockton Companies, LLC (Lockton) notified the NH Attorney General of a cybersecurity incident discovered on November 20, 2024. An unauthorized party accessed a single individual account and computer, obtaining certain files. A review identified personal information belonging to individuals associated with certain Lockton clients. This supplemental notice updates the count of affected New Hampshire residents to 3,268. Lockton engaged third-party experts, notified law enforcement, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 26 weeks / 184 days

Nov 20, 2024

Begins

Nov 20, 2024

Discovered

May 23, 2025

Filed

vs. sector median

+7 wks slower

This filing is one of 24 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_2606bdefd74e0bcc2025-05-23Verified
Delaware State AGbd_d8aed05bb7d559f42025-05-23Verified by operator
California State AGbd_126301bea6b93bb42025-06-27 · +35dVerified by operator
New Hampshire State AGbd_6698308b150da8c42025-06-27 · +35dVerified

Show 6 more filings ↓up to 56d gap

Delaware State AGbd_702f871b1717294b2025-06-27 · +35dVerified by operator
Texas State AGbd_9b8e991fbe3612722025-07-01 · +39dVerified by operator
New Hampshire State AGbd_ab1f596c26daaa252025-04-08 · +45dVerified
California State AGbd_e0c26fe7d81dd2862025-04-08 · +45dVerified by operator
Rhode Island State AGbd_4475760419a1b5882025-04-03 · +50dVerified by operator
Iowa State AGbd_affe720a13d679592025-03-28 · +56dCandidate

Showing first 10 of 23 linked disclosures.

Name: Southeast Series of Lockton Companies, LLC (Lockton)
norm: southeast series of lockton companies llc lockton

Name: Southeast Series of Lockton Companies, LLC (Lockton)
norm: southeast series of lockton companies llc lockton
Industry: Professional Servicesllm

Discovered: Nov 20, 2024
Breach occurred: Nov 20, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 5, 2025
Affected individuals: 3,268state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Office of the Attorney General Consumer Protection Bureau of New Hampshire

During the incident: Immediately began an investigation
Engaged third-party cybersecurity experts
Notified law enforcement
Conducted a robust review of the files to identify individuals whose personal information may have been contained within the files
Began notifying a limited number of clients that were affected by this incident and offered to provide notifications on their behalf
Began mailing notification letters to the affected New Hampshire residents
Offering complimentary credit monitoring and fraud protection services to these individuals
Providing a telephone number for affected individuals to call with any questions regarding the incident
Including a website in the notification letter where individuals can find more information about their credit monitoring product and receive assistance regarding the process
Changes made: Implemented additional security measures designed to enhance the security of its systems and data
Continues to evaluate additional security measures designed to enhance the security of its systems and data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(184 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

Iowa State AGMar 28 · first

Rhode Island State AG+6d

New Hampshire State AG+11d

California State AG+11d

California State AG+56d

Delaware State AG+56d

New Hampshire State AG+56d · this page

California State AG+91d

New Hampshire State AG+91d

Delaware State AG+91d

Texas State AG+95d

Pattern: first filing Mar 28 (IA), last Jul 1 (TX) — a 95-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 23 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/southeast-series-lockton-20250523.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2025
Raw hash: b6f77285f053bf95946881dc4789fdf682ad8f2c4c5135afedf4362c1a10ccec

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entitySoutheast Series of Lockton Companies, LLC (Lockton)

Victim entitySoutheast Series of Lockton Companies, LLC (Lockton)

Incidentdiscovered Nov 20, 2024

Stated responseImmediately began an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov