Aflac confirms data breach affecting around 22.65 million people

On Tuesday, the US-based insurance company Aflac confirmed that it has begun the process of notifying around 22.65 million people that their personal and health data was stolen during a cyberattack. The company, which has around 50 million customers according to its official website, had first disclosed the occurrence of a data breach in June. However, during that initial June disclosure, Aflac did not provide details regarding the number of victims who were affected by the security incident. A spokesperson for Aflac did not respond to requests for comment regarding the notification process.

The full scope of the compromised information was detailed in a regulatory filing submitted to the Texas attorney general. According to the filing, the hackers managed to access and exfiltrate a wide range of sensitive personal and medical records. Aflac confirmed that the stolen data includes:

• Customer names, dates of birth, and home addresses
• Government-issued identification numbers, including driver’s licenses, state ID cards, and passports
• Social Security numbers, which are US government-issued identification numbers
• Medical and health insurance information

In a separate regulatory filing submitted to the Iowa attorney general, Aflac provided additional context regarding the suspected cybercriminals responsible for the breach. The company stated that the hackers may be affiliated with a known cyber-criminal organization. Aflac further noted that federal law enforcement and third-party cybersecurity experts have indicated that this group may have been targeting the insurance industry at large.

Based on the timing and nature of the attack, the breach is likely linked to Scattered Spider, an amorphous collective of primarily young English-speaking hackers. This group was actively targeting the insurance sector at the time of the breach. Aflac was not the only firm affected during this period; the company was hacked at around the same time as several other insurance companies, including similar data breaches at Erie Insurance and Philadelphia Insurance Companies.

Why it matters

This breach underscores the vulnerability of the insurance sector to sophisticated cyber-criminal groups, as Aflac joins a growing list of insurers targeted by similar attacks. The incident highlights how highly sensitive personal and medical data remains a primary target for hacking collectives.