Lockton Companies, LLC, an insurance brokerage firm, has sent notice letters dated October 9, 2026 about a cybersecurity incident that began with a social engineering attack on its employees. A copy of the notice was filed with the Massachusetts Attorney General’s office, and it does not state how many people were notified.
Lockton’s Data Breach Investigation
Lockton Companies, LLC (Lockton) is an insurance brokerage firm that provides services to its clients. In a notice letter dated October 9, 2026, the company told recipients about a cybersecurity incident that may have involved some of their personal information. A sample of the letter was filed with the Massachusetts Attorney General and posted in the state’s public list of data breach notification letters. Massachusetts requires organizations that experience a breach involving residents’ personal information to notify those residents and state regulators, and the Commonwealth publishes the notices it receives.
According to the letter, on August 11, 2026 certain Lockton employees were the victims of a sophisticated social engineering attack that resulted in an unauthorized individual obtaining access to those employees’ user accounts. Lockton says it immediately activated its incident response procedures, including engaging law enforcement and third-party cyber experts. It says the unauthorized access was confined to the affected employee accounts, that there was no lateral movement, that its systems remain secure and that operations continued without disruption.
Social engineering is a method in which an attacker manipulates a person, rather than breaking through software, in order to obtain access. It can involve a convincing phone call, a message that appears to come from a colleague or a vendor, or a request to approve a login. Because the attacker ends up signing in with a real employee’s credentials, the activity can look ordinary to security tools until someone notices. Insurance brokers hold a great deal of information about the people and businesses they serve, including employee benefits, claims and policy records, which makes them a notable target for this kind of attack.
The letter says Lockton then reviewed the files to identify the individuals whose personal information may have been contained in them. After completing that review, it determined that some of the recipient’s personal information was in the files, including the recipient’s name and one or more other data elements. In the sample filed with Massachusetts, the line that would list those elements was left as an unfilled template field, so the specific categories are not publicly known from this filing. This page does not guess at what they were, and each person’s own letter is the best source for which of their details were involved.
To help prevent a similar incident, Lockton says it implemented numerous measures designed to strengthen the security of its systems and data, though the letter does not describe them. As a precaution, it is offering a complimentary 24-month membership in IdentityWorks, a service described as helping detect possible misuse of personal information and providing identity protection support. Enrollment is free and does not affect a person’s credit score. The letter points to its additional pages for activation instructions and lists a toll-free number for questions.
The filing does not say how many people received the letter. Lockton serves many clients across the country, and a notice filed in one state does not mean only residents of that state were affected. The number of people notified overall may be larger than the number tied to any single filing. Public reporting about earlier, separate Lockton incidents involves different dates and different people, and those details are not attributed to this event here.
A notice filed with a state regulator shows that the organization concluded the event met a legal reporting threshold. It is not a finding of fault, and it does not by itself answer whether the safeguards in place were adequate or how long the unauthorized person had access before the activity was stopped. Those are the kinds of questions that attorneys can ask on behalf of people who were harmed.
When Did This Breach Occur?
The letter says the incident occurred on August 11, 2026, when the social engineering attack gave an unauthorized individual access to the employee accounts. The letter itself is dated October 9, 2026. The sources reviewed do not state when the file review finished. Check your own letter for any other dates.
What Information Was Breached?
The letter says the files contained the recipient’s name and one or more additional data elements. The specific elements are shown as an unfilled template field in the sample filed with Massachusetts, so they have not been publicly disclosed. Until you see your own notice, it is prudent to treat details your employer, insurer or benefits plan may have shared with Lockton as potentially at risk.
What You Can Do
If you received a notice from Lockton, or believe you may be affected, consider these steps:
- Read your letter closely and enroll in the complimentary 24-month IdentityWorks membership using the activation details in your letter.
- Place a free fraud alert on your credit file, or consider a free security freeze, with Equifax, Experian and TransUnion.
- Review your account statements and credit reports for activity you do not recognize, and get free reports at annualcreditreport.com.
- Be cautious with emails, texts or calls that ask for personal details or mention your insurance or benefits, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Lockton
If you received a notice about this incident, or believe your personal information was exposed, you may have legal options. Companies that handle sensitive personal information are expected to safeguard it, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
