iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Aon said it identified a cyber incident on February 25, 2022, affecting a limited number of systems. In a Form 8-K filed three days later, the insurance broker said it had opened an investigation and, based on what it knew at the time, had seen no significant operational impact and did not expect a material impact. The filing described an early assessment; it is not a current incident update.
What happened in Aon’s 2022 cyber incident?
Aon plc disclosed the incident in a Form 8-K filed February 28, 2022. The company said it identified the incident on February 25 and that it affected a limited number of systems. Aon did not give a system count or identify affected people, a threat actor, an attack method, or a financial loss in that disclosure.
Aon said it launched an investigation and engaged third-party advisors, incident response professionals, and counsel. The filing did not provide a final forensic conclusion or say whether information had been accessed, stolen, or exposed.
What did Aon say about the impact?
Aon stated in the February 28, 2022 filing: “The incident has not had a significant impact on the Company’s operations.” It also said it did not expect a material impact, based on information then available. Aon emphasized that its assessment was in the early stages, so these statements describe the company’s view at that time, not a definitive finding about eventual effects.
#1 Best Overall
Is this a new Aon cyber incident?
The disclosed event is from February 2022. The available later company filing does not establish a new 2026 incident matching the headline or provide a specific update on the 2022 event. Aon’s 2025 Form 10-K, filed February 13, 2026, discusses cybersecurity incidents and the company’s general security program, but does not identify that discussion as an update to this specific event.
What Aon’s later filing says about cybersecurity
Aon describes a company-wide process in its 2025 Form 10-K. Its Global Emergency Operations Center triages incidents involving customer data, monitors threat intelligence and alerts, and coordinates with privacy and cybersecurity teams. Significant incidents are escalated to a Cyber Incident Governance Committee for review and coordination of mitigation and remediation.
Aon says its controls are designed to align with the NIST Cybersecurity Framework, while clarifying that this does not mean it meets any particular technical standard at all times. It also says it maintains insurance for certain cyber or privacy losses, which may not cover all losses. These statements describe general governance and risk management; they do not document the specific response or outcome for the 2022 incident.
What remains undisclosed
The 2022 Form 8-K gives only a qualitative description of scope and a preliminary operational-impact assessment. It does not establish whether data was accessed or exposed, whether customers were affected, who was responsible, what technique was used, or what the final investigation found. Those details should not be inferred from the company’s general cybersecurity disclosures.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
