John P. Meehan Agency was hacked in July 2024. Affected customers were first finding out in November 2025.

John P. Meehan Agency, an insurance broker in Pennsylvania, was hacked in July 2024, with affected customers first learning of the incident in November 2025. In its notice, the firm says it discovered unusual activity on 8 July 2024 and engaged outside experts, concluding there was unauthorized access to a single employee email account between 2 July 2024 and 8 July 2024, from which data was acquired.

The information involved varied by individual and may have included names, Social Security numbers, driver’s licence or state IDs, passport numbers, financial and payment card information, dates of birth and medical information. The agency’s notification letter is available on its website, and according to Maine Attorney General’s Office, 2,326 people were affected.

Meehan issued a press release on 22 November stating it takes the protection of personal information seriously and offering complimentary services to those affected, though it does not explain what steps will be taken to prevent a future breach. Pennsylvania’s breach notification law, amended in September 2024, requires notification without unreasonable delay, a standard the timeline from July 2024 to November 2025 is likely to be judged against.