HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedIDENTITY_BASICLowContained
MARSH & MCLENNAN COMPANIES, INC.
bd_f54cc90d7abb4835 · schema v1 · pii pii-v1
Full breach record for MARSH & MCLENNAN COMPANIES, INC. →Marsh McLennan notified individuals of a data breach discovered on April 26, 2021, involving unauthorized access to a limited set of data via a third-party software vulnerability. Access occurred between April 22 and April 30, 2021. The incident involved names and other personal information. Marsh McLennan notified law enforcement, terminated access, reset IT admin rights, and offered two years of credit monitoring through Experian. Rhode Island residents (532) were explicitly counted.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_5f0d93b73a89ebf1Washington State AGfiled 2021-06-30Candidate
- bd_983239faa8378189Montana State AGfiled 2021-06-30Verified
- bd_fa303094cee7b57bCalifornia State AGfiled 2021-06-30Verified
- bd_e9678b0aaa98aeb8Oregon State AGfiled 2021-07-01(1d gap)Verified
Source provenance
- Source URL
- https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/MarshMcLennan.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 30, 2021
- Raw hash
- 2b7a8f67205bd8968ebe8f2a020c9fe685797f05dbc8cef84e5501f6d08addc0
Reporting entity
- Name
- MARSH & MCLENNAN COMPANIES, INC.norm: marsh mclennan companies
Victim entity
- Name
- MARSH & MCLENNAN COMPANIES, INC.norm: marsh mclennan companies
Incident
- Discovered
- Apr 26, 2021
- Materiality determined
- —
- Notification sent
- Jun 30, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(65 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.