Lockton breach affects over 1.1 million records — what this means for your vendors
A major Business Associate, Southeast Series of Lockton Companies, LLC (Lockton), reported a hacking/IT incident to HHS OCR on February 28, 2025. The filing states that 1,124,727 individuals were affected. The breach occurred on a network server. As a healthcare administrator, you must determine if your organization uses Lockton for services involving protected health information. If you do, this is a Business Associate breach that may require you to notify your patients or take other steps under HIPAA. Check your vendor contracts immediately to see if Lockton is a covered entity or business associate for your specific operations.
Sources differ:
- The HHS OCR filing records the Lockton breach as affecting 1,124,727 individuals with no settlement information; separately, court filings report that Southeast Series of Lockton Companies has agreed to a $9.9 million class-action settlement, which received preliminary court approval on January 8, 2026.