Aon Hit by Ransomware Attack via Cleo CVE-2024 Exploit

• •Aon was attacked by the Termite ransomware group on October 6, 2026.
• •The attack exploited CVE-2024-50623 in Cleo software, affecting even patched systems.
• •Termite's tactics include encrypting resources and deleting recovery options to maximize disruption.

On October 7, 2026, Aon was reported as a victim of a ransomware attack attributed to the Termite group. The breach was discovered on the same day, with the initial compromise occurring on October 6, 2026. Termite exploited CVE-2024-50623, an unauthenticated remote code execution vulnerability in Cleo file transfer products, including LexiCom, VLTransfer, and Harmony. Despite a patch being released, even systems updated to version 5.8.0.21 remain vulnerable. The attack allows the ransomware to encrypt local and remote resources and delete shadow copies, complicating recovery efforts. At this time, Aon has not released an official statement detailing the specific data compromised. This incident reflects the ongoing threat of ransomware targeting high-value organizations in various sectors.