Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Aon data breach. According to dark web monitoring sources, a hacker group calling itself termite claimed responsibility for a cyberattack on Aon in a post first observed in October 2026, alleging it had gained access to internal company systems. As of this writing, Aon has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Aon
Aon plc is a British-American publicly traded professional services firm (NYSE: AON) headquartered in Dublin, Ireland, with operational headquarters in London and a major North American presence in Chicago, Illinois. The company provides risk management, insurance and reinsurance brokerage, and human capital consulting services worldwide, operating through divisions covering risk consulting, retirement consulting, and health consulting. As of 2024, Aon had approximately 66,000 employees and reported revenue of approximately US$15.70 billion.
What Happened?
On October 7th, 2026, the Termite ransomware group listed Aon as a victim on its dark web leak site. The claim was reported by Ransomware.live and flagged by RedPacket Security, which has noted that Termite listings have in some cases included unverified or fabricated victim claims. The Termite post did not specify whether any systems were encrypted, whether data was exfiltrated, what data types may have been involved, or any ransom amount. No confirmation from Aon, no regulatory filing, and no independent corroborating sources have been found as of October 7th, 2026.
Termite is a ransomware group first identified in late 2024, known for using a modified version of Babuk ransomware and employing double extortion tactics — meaning it typically both encrypts victim systems and threatens to publish stolen data. The group has been linked to an attack on supply chain software firm Blue Yonder and to exploitation of Cleo file transfer vulnerabilities, and has claimed approximately 48–50 victims across multiple countries.
This is not Aon’s first brush with a cybersecurity incident. In February 2022, Aon disclosed that an unauthorized third party had accessed its systems from approximately December 29th, 2020 through February 26th, 2022 — a period of over a year. That breach compromised names, Social Security numbers, driver’s license numbers, and benefit enrollment information, and ultimately affected 145,889 individuals (revised upward from an initial count of 31,799). Aon confirmed at the time that the 2022 incident was not a ransomware attack and did not involve file encryption or malware. That breach led to a class action lawsuit, Flores v. Aon Corporation, filed in Illinois state court in June 2022. The trial court initially dismissed the complaint with prejudice in December 2022, but an Illinois appellate court revived negligence and certain other claims in September 2023. No litigation has been identified in connection with the current October 2026 Termite claim.
Key Facts at a Glance
- Company or Organization: Aon plc
- Industry: Professional Services / Financial Services (insurance brokerage, risk management, human capital consulting)
- Location: Dublin, Ireland (corporate headquarters); London, United Kingdom (operational headquarters); Chicago, Illinois (major North American presence)
- Incident type: Ransomware claim (attacker-side allegation only; unconfirmed)
- Date of breach: Not confirmed; Ransomware.live lists the claim as first observed on October 7th, 2026
- Prior breach: Yes — unauthorized access from approximately December 29th, 2020 through February 26th, 2022; 145,889 individuals affected; names, Social Security numbers, driver’s license numbers, and benefit enrollment information compromised
- Litigation status: Flores v. Aon Corporation (2022 breach) — negligence and certain other claims revived on appeal in September 2023; no litigation identified for the current 2026 claim
- Source: Ransomware.live — Termite claim, October 7th, 2026; RedPacket Security — Termite Ransomware Victim: Aon; SOCRadar — Dark Web Profile: Termite Ransomware; Wikipedia — Aon plc
What Should You Do?
Even though this incident remains an unconfirmed allegation, it is a reasonable precaution to monitor your financial accounts and credit reports closely. You can request a free credit report from each of the three major bureaus at AnnualCreditReport.com. Consider placing a fraud alert or a credit freeze with Equifax, Experian, and TransUnion to reduce the risk of new accounts being opened in your name. If you receive any notice from Aon about this incident or any identity theft protection enrollment offer, enroll promptly and note any enrollment deadline. If you believe your information may have been misused, report it at IdentityTheft.gov, which can help you create a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
