What should I do if I was affected by this healthcare data breach?

If you were affected, monitor your credit reports and explanation of benefits statements for suspicious activity, take advantage of any free credit monitoring offered, consider freezing your credit, and document any unauthorized use of your health information. You may also be eligible to join a class action lawsuit for compensation.

How do I know if my data was included in this breach?

The breached organization is required by HIPAA to notify affected individuals within 60 days. Check your mail and email for breach notification letters. You can also contact the organization directly to ask if your records were affected. If the breach involved 500+ individuals, it is publicly reported to HHS and listed in their breach portal.

Southeast Series of Lockton Companies, LLC (Lockton) Data Breach

Lockton Companies Network Server Breach Affects 1.1M

critical severityReported February 28, 2025HHS OCR VerifiedGeorgia

What happened in the Southeast Series of Lockton Companies, LLC (Lockton) data breach?

The Southeast Series of Lockton Companies, LLC (Lockton) data breach was reported on February 28, 2025 and affected 1,124,727 individuals. The breach type was Hacking/IT Incident involving Network Server. This breach occurred in Georgia. Under HIPAA, affected patients must be notified within 60 days and may be entitled to credit monitoring services.

Harding Hall

1,124,727

Individuals Affected

Hacking/IT Incident

Breach Type

Network Server

Breach Location

Yes

Business Associate

Scale:Larger than 97% of healthcare breaches

1 year ago

HIPAA Category:hacking/IT incident

Visibility:national

Southeast Series of Lockton Companies, LLC (Lockton) Breach Details

Southeast Series of Lockton Companies Data Breach Report

Opening Summary

Southeast Series of Lockton Companies, LLC, a major insurance and benefits administration firm based in Georgia, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the Georgia Attorney General on February 28, 2025, affecting approximately 1,124,727 individuals. This incident represents one of the largest healthcare-related data breaches reported in early 2025 and underscores the ongoing vulnerability of healthcare administrative systems to sophisticated cyber attacks. The unauthorized access to Lockton's network servers may have exposed sensitive personal health information and related administrative data maintained by the organization.

Discovery and Response Timeline

The specific date of breach discovery has not been publicly disclosed in available records, though the submission date of February 28, 2025, indicates the breach was reported to state authorities within the required HIPAA notification timeframe. Upon discovery of the unauthorized access, Lockton initiated an investigation to determine the scope and nature of the compromised data. The organization's response included forensic analysis of affected network systems, notification preparation for impacted individuals, and coordination with relevant regulatory authorities. As a business associate handling protected health information on behalf of covered entities, Lockton was obligated under HIPAA Breach Notification Rule requirements to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. The company also notified the U.S. Department of Health and Human Services and relevant state attorneys general as required by federal regulations.

Technical Details of the Breach

The breach occurred through unauthorized access to Lockton's network server infrastructure, which typically indicates a compromise of centralized data storage systems rather than a single endpoint or portable device. Network server breaches of this magnitude often result from sophisticated attack vectors such as exploitation of unpatched software vulnerabilities, credential compromise through phishing or social engineering, weak authentication mechanisms, or advanced persistent threat (APT) activity. The fact that over 1.1 million individuals were affected suggests the compromised servers contained consolidated databases or repositories of personal information across multiple client organizations. Network-based breaches often allow threat actors extended access periods before detection, potentially enabling exfiltration of large data volumes. The breach classification as a "hacking/IT incident" rather than theft or loss indicates intentional unauthorized access rather than accidental exposure or physical theft of devices.

Organizational Context

Lockton Companies is one of the largest privately-held insurance brokerages and employee benefits consulting firms in the United States. The Southeast Series represents the company's operations in the southeastern region, with significant presence in Georgia and surrounding states. As an insurance broker and benefits administrator, Lockton handles sensitive health information for numerous employer clients, including employee health insurance enrollment data, claims information, and related personal health details. The organization functions as a business associate under HIPAA, meaning it processes protected health information on behalf of covered entities such as health plans and healthcare providers. Lockton's operations span multiple states and serve thousands of employer clients ranging from small businesses to large enterprises, making it a critical node in the healthcare administrative infrastructure.

Impact and Affected Individuals

The breach affected 1,124,727 individuals, making this one of the largest healthcare data breaches reported in 2025. The affected population likely includes employees of Lockton's client organizations who had personal information stored in the company's systems, as well as potentially dependents and beneficiaries covered under health plans administered through Lockton. Individuals affected by this breach may have had various categories of personal information exposed, depending on their relationship to Lockton's client organizations and the specific systems compromised. Notification of affected individuals was required to include information about the breach, the types of data exposed, steps the company was taking to address the incident, and recommended protective measures. Given the scale of this breach, notification efforts likely involved multiple communication channels including direct mail, email, and potentially a dedicated breach notification website or call center.

HIPAA Compliance and Industry Context

Under the HIPAA Breach Notification Rule, breaches affecting more than 500 residents of a state or jurisdiction must be reported to prominent media outlets in addition to individual notifications and regulatory authorities. A breach of this magnitude almost certainly triggered media notification requirements in Georgia and potentially other states where affected individuals reside. Network server breaches represent a significant portion of healthcare data breaches, accounting for approximately 40-50% of reported incidents in recent years according to HHS breach notification data. The healthcare industry has experienced an increase in sophisticated cyber attacks targeting administrative systems and business associates, as these organizations often maintain consolidated databases of sensitive information across multiple covered entities. The involvement of a business associate in this breach highlights the importance of supply chain security in healthcare, as breaches at service providers can affect far more individuals than direct breaches at covered entities. Organizations handling healthcare data are required to implement appropriate administrative, physical, and technical safeguards under HIPAA Security Rule standards, including access controls, encryption, audit controls, and incident response procedures.

What Data Was Exposed

While specific data elements have not been detailed in public disclosures, individuals affected by this network server breach may have had the following types of protected health information and personal data exposed: - Full names and contact information (addresses, phone numbers, email addresses) - Social Security numbers - Date of birth and age information - Health insurance policy numbers and group numbers - Employer information and employment status - Health plan enrollment and coverage details - Claims history and healthcare service information - Dependent and beneficiary information - Financial account information related to health benefits - Medical history summaries or diagnoses (depending on systems compromised) - Provider information and healthcare provider relationships - Prescription medication information - Billing and payment information - Potentially banking information for direct deposit or payment purposes The exact scope of exposed data depends on which specific network servers were compromised and what information was stored on those systems. As a benefits administrator, Lockton likely maintained comprehensive employee health records and enrollment data across multiple client organizations.

Risks to Patients

Individuals affected by this breach face multiple categories of risk related to the exposure of their personal health information and identity data: **Identity Theft and Financial Fraud**: The exposure of Social Security numbers, dates of birth, and names creates significant risk for identity theft. Threat actors can use this information to open fraudulent accounts, apply for credit, or commit other forms of financial fraud. The combination of health insurance information with personal identifiers increases the sophistication of potential fraud schemes. **Medical Identity Theft**: Criminals may use exposed health insurance information and personal identifiers to obtain medical services, prescription medications, or medical equipment under the victim's identity. This can result in fraudulent charges, incorrect medical records, and potential harm if false medical information is added to legitimate health records. **Insurance Fraud and Coverage Disruption**: Threat actors with access to health insurance policy numbers and enrollment information may attempt to modify coverage, add dependents, or change beneficiary designations. This could result in coverage disruptions or unauthorized changes to health benefits. **Targeted Phishing and Social Engineering**: Criminals may use exposed personal information to conduct sophisticated phishing attacks or social engineering schemes targeting affected individuals, impersonating healthcare providers, insurers, or employers. **Privacy Violations and Stigmatization**: Exposure of health information, including diagnoses, medications, or treatment history, creates privacy risks and potential for discrimination or stigmatization if the information is disclosed to unauthorized parties. **Long-term Monitoring Burden**: Affected individuals must monitor credit reports, financial accounts, and healthcare records for signs of fraudulent activity, creating ongoing burden and stress. **Regulatory and Compliance Risks**: Organizations that were clients of Lockton may face regulatory scrutiny and potential HIPAA violations if they failed to adequately oversee their business associate's security practices.

What to Do If You Were Affected by the Southeast Series of Lockton Companies, LLC (Lockton) Breach

Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) by contacting one bureau, which will notify the others. This alerts creditors to verify your identity before extending credit. Consider placing a credit freeze for stronger protection, which prevents new accounts from being opened without your authorization.
Monitor your credit reports regularly for suspicious activity by obtaining free annual credit reports from www.annualcreditreport.com. Review accounts, inquiries, and personal information for unauthorized entries. Consider using credit monitoring services that provide alerts for changes to your credit file.
Monitor your health insurance accounts and explanation of benefits (EOBs) for unauthorized claims, coverage changes, or unfamiliar medical services. Contact your health plan immediately if you notice suspicious activity, and request a copy of your complete medical records to verify accuracy.
Monitor your financial accounts, including bank accounts and credit cards, for unauthorized transactions. Set up account alerts with your financial institutions to notify you of unusual activity. Consider changing passwords for financial accounts and other sensitive online accounts using strong, unique passwords.
Watch for suspicious communications claiming to be from healthcare providers, insurers, or government agencies. Do not click links or provide information in response to unsolicited communications. Verify any requests by contacting organizations directly using phone numbers or websites you know to be legitimate.
Consider placing a security freeze with the Social Security Administration's fraud prevention service at IdentityTheft.gov if you suspect your Social Security number has been compromised. File a report with the Federal Trade Commission if you experience identity theft.
Retain documentation of the breach notification and any protective measures you implement. Keep records of credit monitoring, fraud alerts, and any fraudulent activity you discover, as this documentation may be needed for dispute resolution or regulatory complaints.
Review your health insurance coverage and enrollment information with your employer or health plan to ensure all details are accurate and no unauthorized changes have been made to your benefits or coverage.

Monitor Your Medical Records

Request copies to check for unauthorized changes

Check More Georgia Breaches

Search all breaches reported in Georgia

Were You Affected?

Patients affected by large healthcare data breaches may be eligible for compensation through class action lawsuits.

Learn about data breach lawsuits

Technical Notes

This breach involved unauthorized access to network server infrastructure, which represents a centralized data storage and processing environment. Network server compromises typically indicate either exploitation of software vulnerabilities in server operating systems or applications, compromise of administrative credentials through phishing or credential stuffing attacks, or deployment of malware or remote access tools. The scale of the breach (1.1+ million individuals) suggests the compromised servers contained consolidated databases or data repositories serving multiple client organizations. Network-based breaches often allow extended dwell time before detection, potentially enabling threat actors to exfiltrate large volumes of data. The breach classification as a hacking/IT incident indicates intentional unauthorized access rather than accidental exposure. As a business associate, Lockton was required to implement HIPAA-compliant security controls including access controls, encryption of data in transit and at rest, audit logging, vulnerability management, and incident response procedures. The breach suggests potential gaps in one or more of these security domains. Network server breaches of this magnitude typically warrant forensic investigation to determine attack vectors, timeline of compromise, scope of data access, and whether data was exfiltrated. Affected organizations should review their business associate agreements with Lockton and assess whether contractual security requirements were met.

Frequently Asked Questions

How many people were affected by the Southeast Series of Lockton Companies, LLC (Lockton) data breach?

The Southeast Series of Lockton Companies, LLC (Lockton) data breach affected 1,124,727 individuals. It was reported to the HHS Office for Civil Rights on February 28, 2025 and classified as a hacking/it incident incident in Georgia.

When was the Southeast Series of Lockton Companies, LLC (Lockton) breach reported?

The Southeast Series of Lockton Companies, LLC (Lockton) breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights on February 28, 2025. Under HIPAA, covered entities must report breaches affecting 500 or more individuals within 60 days of discovery.

What type of breach occurred at Southeast Series of Lockton Companies, LLC (Lockton)?

The Southeast Series of Lockton Companies, LLC (Lockton) breach was classified as a "Hacking/IT Incident" incident involving "Network Server." This breach is rated critical severity based on the number of individuals affected and the type of data involved.

What data was exposed in the Southeast Series of Lockton Companies, LLC (Lockton) breach?

What should I do if I was affected by the Southeast Series of Lockton Companies, LLC (Lockton) data breach?

1. Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) by contacting one bureau, which will notify the others. This alerts creditors to verify your identity before extending credit. Consider placing a credit freeze for stronger protection, which prevents new accounts from being opened without your authorization. 2. Monitor your credit reports regularly for suspicious activity by obtaining free annual credit reports from www.annualcreditreport.com. Review accounts, inquiries, and personal information for unauthorized entries. Consider using credit monitoring services that provide alerts for changes to your credit file. 3. Monitor your health insurance accounts and explanation of benefits (EOBs) for unauthorized claims, coverage changes, or unfamiliar medical services. Contact your health plan immediately if you notice suspicious activity, and request a copy of your complete medical records to verify accuracy. 4. Monitor your financial accounts, including bank accounts and credit cards, for unauthorized transactions. Set up account alerts with your financial institutions to notify you of unusual activity. Consider changing passwords for financial accounts and other sensitive online accounts using strong, unique passwords. 5. Watch for suspicious communications claiming to be from healthcare providers, insurers, or government agencies. Do not click links or provide information in response to unsolicited communications. Verify any requests by contacting organizations directly using phone numbers or websites you know to be legitimate. 6. Consider placing a security freeze with the Social Security Administration's fraud prevention service at IdentityTheft.gov if you suspect your Social Security number has been compromised. File a report with the Federal Trade Commission if you experience identity theft. 7. Retain documentation of the breach notification and any protective measures you implement. Keep records of credit monitoring, fraud alerts, and any fraudulent activity you discover, as this documentation may be needed for dispute resolution or regulatory complaints. 8. Review your health insurance coverage and enrollment information with your employer or health plan to ensure all details are accurate and no unauthorized changes have been made to your benefits or coverage.

What are the risks to patients from the Southeast Series of Lockton Companies, LLC (Lockton) breach?

How do I file a HIPAA complaint about the Southeast Series of Lockton Companies, LLC (Lockton) breach?

You can file a HIPAA complaint with the HHS Office for Civil Rights (OCR) online at ocrportal.hhs.gov within 180 days of discovering the violation. The complaint must identify the covered entity (Southeast Series of Lockton Companies, LLC (Lockton)) and describe the acts or omissions you believe violated HIPAA. You can also contact OCR's toll-free hotline at 1-800-368-1019.

How can I check if I was affected by a healthcare data breach?

You can search for healthcare data breaches by provider name, state, or breach type using MedicalRecords.com's free Breach Check tool at medicalrecords.com/breach-check. The tool searches 1,638 breaches reported to the HHS Office for Civil Rights. Covered entities are also required to notify affected individuals directly.