$21 Million Settlement Resolves Data Breach Claims Against Arthur J. Gallagher

In the fall of 2020, Arthur J. Gallagher and Co., one of the largest insurance brokerage and risk management firms in the world, disclosed that an intruder had been inside its network for months. The ransomware attack ran from June 3 through September 26, 2020, and it reached data belonging to employees, policyholders, and other individuals the company served. Notification letters eventually went out to approximately 3,492,654 people.

The exposed records included some of the most sensitive categories of personal information: Social Security numbers, tax identification numbers, driver's license and passport numbers, dates of birth, usernames and passwords, employee identification numbers, financial account and credit card information, medical records, health insurance details, and biometric data. For the people whose information was taken, the combination posed serious and lasting identity theft risk.

Plaintiffs alleged that Gallagher failed to implement reasonable security measures and, critically, waited close to a year before informing those whose data had been compromised. Multiple lawsuits were filed across the country and consolidated before the U.S. District Court for the Northern District of Illinois under Case No. 1:22-cv-00137. The complaints brought claims of negligence, breach of contract, and violations of state privacy statutes.

The court appointed M. Anderson Berry of Clayeo C. Arnold, APC (Arnold Law Firm) as class counsel for the settlement class, alongside Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC and John A. Yanchunis of Morgan and Morgan. The litigation team pursued both the adequacy of Gallagher's pre-breach security and the company's delayed disclosure.

In September 2024 the court granted preliminary approval of a $21 million settlement. The agreement provided class members with reimbursement for documented out-of-pocket losses up to $6,000 per person, three years of credit monitoring and identity theft protection, and a cash alternative for those who preferred it. California residents were entitled to an additional $100 payment. Final approval was granted on February 27, 2025.