Aon Found an Intruder With 14 Months of Intermittent Access and Notified 145,889 People

Aon plc reported to the Securities and Exchange Commission on Feb. 28, 2022, that it had identified a cyber incident on Feb. 25 affecting a limited number of systems, and that it did not expect a material impact. Letters to individuals dated May 27, 2022, said an unauthorised party had accessed systems at various times between Dec. 29, 2020, and Feb. 26, 2022. The data taken included names with Social Security numbers, driver’s license numbers and, for a small number, benefits enrolment information.

The count grew as filings arrived. An early figure of about 28,700 appeared in June 2022. By July the Maine attorney general’s filing, as reported, put it at 145,889, described as North American customers.

The broker’s spokesperson told trade press that Aon was not a ransomware victim, had not lost control of its systems and had not paid anyone to restore anything. The attacker no longer had access, the company said, and there was no indication the data had been further copied or shared. What the intrusion was, if not ransomware, and how it began were not described. A 14-month window with access at various times describes a foothold that was used repeatedly rather than a single event, and the file records that without knowing more.

Aon arranges insurance and benefits for employers. The people it notified were largely employees of client companies whose data passed through Aon’s systems for enrolment and claims. As at Gallagher, filed at 20-0928, the affected population had no relationship with the organisation that lost their data. The letter came from a company most of them had never heard of, about a benefit plan their employer had chosen.

Class actions followed in Illinois in June and July 2022. An appeals court revived one in September 2023 after a standing dismissal. No regulatory penalty was found, and no vector was ever disclosed.