Aflac recently concluded a months-long investigation into a cybersecurity breach that occurred in June, revealing that the scale of the incident was much larger than initially reported. While the Georgia-based insurer managed to halt the intrusion within hours of detection, hackers successfully exfiltrated a significant volume of data. The company clarified that the event did not involve ransomware and did not disrupt its daily operations, though the theft of records was extensive.
GET 50% Discount for VPN/ANTIVIRUS SOFTWARE AT 911Cyber - CODE: bit5025
The stolen files contained a wide range of sensitive data belonging to customers, beneficiaries, employees, and agents within the company’s United States business. Among the compromised information were Social Security numbers, insurance claim details, and private health data. State regulators have been notified of the scale of the breach, with officials in Texas alone reporting that more than two million of their residents were impacted by the theft.
Following the conclusion of the internal probe on December 4, Aflac began mailing notification letters to the nearly 23 million victims involved. To mitigate the risk of identity theft, the company is providing affected individuals with two years of credit monitoring and protection services at no cost. Recipients of these letters have until April 18, 2026, to enroll in the program and secure their accounts.
This breach was part of a broader series of attacks targeting the insurance sector by a criminal collective known as Scattered Spider. This group is notorious for using social engineering tactics, such as posing as IT support staff, to gain unauthorized access to corporate networks. Other major firms, including Erie Insurance and Philadelphia Insurance Companies, were also targeted during the same period as part of this aggressive hacking campaign.
Law enforcement agencies have made progress in dismantling the group’s infrastructure, including taking down a primary data leak site and arresting two members in the United Kingdom. Recent filings from the Justice Department indicate that Scattered Spider has extorted over 115 million dollars from various organizations over the last three years. Aflac continues to cooperate with federal authorities as they investigate the full scope of the group’s criminal activities.
Source: More Than 22 Million Aflac Customers Impacted By June Data Breach