Lockton breach affects over 1.1 million records — what this means for your vendors
A major Business Associate, Southeast Series of Lockton Companies, LLC (Lockton), reported a hacking/IT incident to HHS OCR on February 28, 2025. The filing states that 1,124,727 individuals were affected. The breach occurred on a network server. As a healthcare administrator, you must determine if your organization uses Lockton for services involving protected health information. If you do, this is a Business Associate breach that may require you to notify your patients or take other steps under HIPAA. Check your vendor contracts immediately to see if Lockton is a covered entity or business associate for your specific operations.
Sources differ:
- The HHS OCR breach portal lists 1,124,727 individuals affected; the Maine Attorney General's notice lists 1,154,625. Government source
Primary source: HHS OCR Breach Portal — Southeast Series of Lockton Companies, LLC (Lockton) (GA) · reported 02/28/2025 · 1,124,727 individuals · Checked against the record 2026-10-23