Alight Solutions LLC

The California Office of the Attorney General disclosed a data breach at **Alight Solutions LLC**, where **personal information—including Social Security Numbers (SSNs)**—was exposed in **emails sent to participants**. The incident traces back to **September 22, 2014**, with additional exposure occurring via **URLs containing sensitive data from October 1, 2016**. The breach was formally reported on **August 20, 2019**, following an investigation. The compromised data primarily involved **personally identifiable information (PII)**, raising risks of identity theft and fraud. In response, Alight offered **two years of identity theft protection** to affected individuals. The delayed discovery and reporting of the breach—spanning nearly **five years**—heightened concerns over data security protocols and the potential long-term misuse of the exposed information. The incident underscored vulnerabilities in handling **sensitive employee or participant data**, particularly when transmitted via unsecured channels like email or accessible URLs.

Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-149919

TPRM report: https://www.rankiteo.com/company/alightsolutions

"id": "ali731082025",
"linkid": "alightsolutions",
"type": "Breach",
"date": "9/2014",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Human Resources and Business Solutions',
                        'location': 'United States (California)',
                        'name': 'Alight Solutions LLC',
                        'type': 'Corporation'}],
 'customer_advisories': 'Offered two years of identity theft protection to '
                        'affected individuals',
 'data_breach': {'personally_identifiable_information': 'Yes (Social Security '
                                                        'Numbers)',
                 'sensitivity_of_data': 'High (includes personally '
                                        'identifiable information)',
                 'type_of_data_compromised': ['Social Security Numbers',
                                              'sensitive data in emails and '
                                              'URLs']},
 'date_publicly_disclosed': '2019-08-20',
 'description': 'The California Office of the Attorney General reported that '
                'Alight Solutions LLC experienced a data breach involving '
                'personal information, including Social Security Numbers, in '
                'emails sent to participants. The breach dates back to '
                'September 22, 2014, and also involved URLs containing '
                'sensitive data from October 1, 2016, with the breach reported '
                'on August 20, 2019. An investigation was conducted, and '
                'Alight has offered two years of identity theft protection to '
                'affected individuals.',
 'impact': {'brand_reputation_impact': 'Potential negative impact due to '
                                       'exposure of sensitive personal data',
            'data_compromised': ['Social Security Numbers',
                                 'sensitive data in URLs'],
            'identity_theft_risk': 'High (Social Security Numbers exposed)'},
 'investigation_status': 'Completed (investigation conducted)',
 'references': [{'source': 'California Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'California Office of '
                                                       'the Attorney General'},
 'response': {'incident_response_plan_activated': 'Yes (investigation '
                                                  'conducted)',
              'law_enforcement_notified': 'Yes (reported to California Office '
                                          'of the Attorney General)',
              'remediation_measures': 'Offered two years of identity theft '
                                      'protection to affected individuals'},
 'title': 'Alight Solutions LLC Data Breach Involving Personal Information',
 'type': 'Data Breach'}