Southeast Series of Lockton Companies, LLC (“Lockton”) Data Breach Notice (Oregon Attorney General): What Was Exposed & What To Do

On March 20, 2025, Southeast Series of Lockton Companies, LLC (“Lockton”) notified Oregon residents of a data breach through a filing with the Oregon Department of Justice. The filing places the incident itself on November 20, 2024, and states that 112,702 people may be affected. The notice describes the exposed material as personal information.

For anyone who has dealt with Lockton or related insurance services, the practical question is straightforward: whether their own details were among those involved, and what steps reduce follow-on risk. Public detail beyond the filing’s core points remains limited.

Breaking down the breach

According to the Oregon Attorney General notice, Lockton reported the matter on March 20, 2025. The same filing dates the underlying incident to November 20, 2024. It identifies 112,702 people as potentially affected and characterizes the exposed data as personal information per the breach notification.

The public record supplied here does not describe how the incident occurred, what systems were involved, how long unauthorized access lasted, or whether data was exfiltrated, viewed, or otherwise misused. No threat actor is named. Those elements are undisclosed in the available facts.

How a breach like this happens

Incidents that lead to notices of this kind commonly begin with compromised credentials, a vulnerable remote service, phishing that yields access to internal accounts, or malware that moves laterally once inside a network. In insurance and brokerage environments, attackers often seek repositories that hold client files, policy records, or supporting identity documents because those collections are concentrated and reusable for fraud.

Once access is obtained, typical next steps include locating file shares or databases, copying or encrypting material, and sometimes attempting to monetize it. Organizations then investigate, determine scope, and issue notices when personal information appears to have been involved. None of this general pattern identifies a specific method or group in the Lockton matter; the filing does not attribute a technique or actor.

About Southeast Series of Lockton Companies, LLC (“Lockton”)

Lockton is part of the broader Lockton family of insurance brokerage and risk-management businesses. Firms in this sector advise clients on commercial and personal coverage, place policies, and handle claims-related and underwriting support work. In the course of that work they routinely collect and retain information needed to identify clients, assess risk, and administer policies.

A breach affecting such an organization is consequential because the data held is often tied to real identities, financial relationships, and ongoing coverage. Even when only a high-level category such as “personal information” is named, the volume of people notified—here 112,702—indicates a large potential footprint across customers, employees, or other individuals whose records were stored in the affected environment.

The information in question

The breach notification names the exposed data as personal information. It does not itemize fields such as Social Security numbers, driver’s license numbers, financial account details, health data, or contact information in the facts provided. Exact contents beyond that label are therefore unconfirmed in the public summary.

Organizations of this type typically maintain names, addresses, dates of birth, policy numbers, and other identifiers required for insurance placement and servicing. Whether any of those specific elements were involved in this incident is not stated in the Oregon filing details given here. Readers should treat only the notified category—“personal information”—as established by the disclosure.

What's at stake

For affected individuals, the main risks are misuse of identity details for account takeover, fraudulent applications for credit or benefits, targeted phishing that references real relationships with an insurer, and longer-term monitoring burdens. Because the notice covers more than one hundred thousand people, the pool of potential targets is large even if not every record is equally sensitive.

For the organization, consequences include notification and support costs, regulatory scrutiny, possible civil claims, and reputational pressure from clients who expect careful handling of insurance-related data. The filing does not assign fault or describe security controls; those questions lie outside the disclosed facts.

What to do if you're exposed

If you believe you may be among the 112,702 people referenced, practical first steps are limited and concrete:

• Review any notice you received from Lockton for the exact data categories it lists and any offer of credit monitoring or identity-protection services.
• Place a fraud alert or credit freeze with the major consumer reporting agencies if the notice or your own risk assessment warrants it.
• Monitor financial and insurance accounts for unfamiliar activity and change passwords on related online portals, using unique credentials and multi-factor authentication where available.
• Treat unexpected calls, emails, or texts that reference Lockton or your policies with caution; verify through official channels rather than links or numbers supplied in the message.
• Keep records of the notice date and any reference numbers in case you later need to dispute fraudulent activity.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach datasets, which can help you prioritize further monitoring. Public detail on this incident remains anchored to the Oregon filing: reported March 20, 2025, incident dated November 20, 2024, 112,702 people, and personal information as the named category.

AICompiled with AI assistance from public sources and published under our editorial standards.