Marsh McLennan data breach: what happened and what to do

Marsh McLennan told people in June 2021 that an attacker used a flaw in third-party software from about April 22, 2021. Names and Social Security or tax ID numbers were exposed, and some notices also listed driver's license numbers.

View all 13,177 breaches

Breach date: 22 Apr 2021
Data exposed: Names, Social security numbers, Driver's licenses
Last updated: 28 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Marsh McLennan, the insurance broker and professional services group, found on April 26, 2021 that an unauthorized person had used a vulnerability in a third party's software to get into its systems. According to the notice letter filed with state attorneys general, the access started around April 22 and ended on April 30. The company told law enforcement about it.

The main notice letter is dated June 30, 2021. Maine's records show most letters went out that day, with smaller groups notified on July 29 and August 12. The letter says the company holds data on current and former staff and their families, employees of clients and contractors, job applicants, investors, and people connected to businesses it bought. So you might have been notified without ever having dealt with Marsh McLennan directly.

Trade press reported that the exposed records included names and Social Security numbers or other federal tax ID numbers. A later Maine filing also lists driver's license or state ID numbers. The company has not published a total number of people affected, and the figures filed with individual states cover residents of those states only.

A name plus a Social Security number is what identity thieves need to open credit in someone else's name, file a fake tax return or apply for benefits. That risk lasts for years, because the number doesn't change. The company says it saw no evidence that the data had been misused, and it offered two years of credit monitoring, identity theft detection and resolution services, and identity theft insurance of up to $1 million.

If you got the letter, enroll in the monitoring it offers if you want it, but the credit freeze below does more to stop new accounts being opened. Serus can't remove data that has already been taken in a breach. It watches breach databases and the dark web for your details and alerts you when they appear, so you know what to act on.

Sources checked: maine.gov, oag.ca.gov, businessinsurance.com

Last verified against the official page: 28 Oct 2026

How we research this Report an error

What to do if you were in it

1

Freeze your credit if a Social Security number was involved

A credit freeze is free and stops new accounts from being opened in your name. The FTC explains how to place one with Equifax, Experian and TransUnion: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
2

Check your credit reports for accounts you don't recognize

You can get free reports from all three bureaus at annualcreditreport.com. Look for new accounts, unfamiliar addresses and hard inquiries you didn't make.
3

Report misuse at IdentityTheft.gov

If someone uses your number, the FTC's site at https://www.identitytheft.gov/databreach builds a recovery plan and the reports you need.
4

Treat unexpected calls and emails about your insurance or benefits with suspicion

Scammers use breach details to sound credible. Contact the company through a phone number or site you find yourself, not one in the message.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see where your details have shown up.

Official filings

Washington Attorney General , filed 30 Jun 2021 : 2,550 people

Timeline

22 Apr 2021
The breach happened
30 Jun 2021
Reported to the Washington Attorney General

Frequently asked

Was I affected by the Marsh McLennan breach?

If you got a notice letter, your information was involved. Marsh McLennan wrote to current and former employees and their families, client and contractor staff, applicants, investors and others connected to companies it acquired.

What was exposed?

Names and Social Security or other federal tax ID numbers, according to press reports of the notice. A later Maine filing also lists driver's license or state ID numbers.

How many people were affected?

The company's letters filed with state attorneys general give counts for each state's residents only. No total has been published.

Should I freeze my credit?

The FTC says a freeze is free and restricts access to your credit report, which makes it harder for someone to open new accounts in your name. Consider it if a Social Security number was involved.