Aflac Hit by Cyberattack as Scattered Spider Targets Insurance Sector
Aflac, a major U.S. insurance provider, disclosed a cybersecurity breach on June 12, linking the incident to the cybercrime group Scattered Spider. Known for its advanced social engineering tactics, the group has increasingly targeted financial services and insurance firms, with recent attacks also affecting Erie Insurance, which now faces a proposed class-action lawsuit over alleged inadequate security measures.
The breach at Aflac was detected and contained within hours, though the investigation supported by external cybersecurity experts remains ongoing. Initial findings suggest the attackers gained access through social engineering rather than ransomware. While Aflac’s core operations, including claims processing and customer service, remain unaffected, the exposed data may include claims records, health details, Social Security numbers, and personal information tied to policyholders, beneficiaries, employees, and agents.
Aflac has not yet determined the full scope of the breach or the number of affected individuals but is offering 24 months of complimentary credit monitoring, identity theft protection, and Medical Shield coverage to those who contact its call center. The incident reflects a broader trend of cyber threats exploiting both malicious attacks and internal vulnerabilities, such as software misconfigurations.
The breach follows a pattern of recent intrusions against insurers, underscoring the sector’s growing appeal to sophisticated threat actors. Aflac continues to assess the impact and will provide updates as the investigation progresses.
Aflac cybersecurity rating report: https://www.rankiteo.com/company/aflac
"id": "AFL1770237527",
"linkid": "aflac",
"type": "Breach",
"date": "6/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Insurance',
'location': 'U.S.',
'name': 'Aflac',
'type': 'Insurance Provider'}],
'attack_vector': 'Social Engineering',
'customer_advisories': 'Offering 24 months of complimentary credit '
'monitoring, identity theft protection, and Medical '
'Shield coverage to affected individuals',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Claims records',
'Health details',
'Social Security numbers',
'Personal information']},
'date_detected': '2024-06-12',
'date_publicly_disclosed': '2024-06-12',
'description': 'Aflac, a major U.S. insurance provider, disclosed a '
'cybersecurity breach on June 12, linking the incident to the '
'cybercrime group Scattered Spider. The breach was detected '
'and contained within hours, with initial findings suggesting '
'attackers gained access through social engineering. Exposed '
'data may include claims records, health details, Social '
'Security numbers, and personal information tied to '
'policyholders, beneficiaries, employees, and agents.',
'impact': {'data_compromised': 'Claims records, health details, Social '
'Security numbers, personal information',
'identity_theft_risk': 'High',
'operational_impact': 'Core operations (claims processing and '
'customer service) remain unaffected'},
'initial_access_broker': {'entry_point': 'Social Engineering'},
'investigation_status': 'Ongoing',
'references': [{'date_accessed': '2024-06-12',
'source': 'Cyber Incident Description'}],
'response': {'communication_strategy': 'Public disclosure, offering credit '
'monitoring and identity theft '
'protection',
'containment_measures': 'Contained within hours',
'incident_response_plan_activated': 'Yes',
'third_party_assistance': 'External cybersecurity experts'},
'threat_actor': 'Scattered Spider',
'title': 'Aflac Cybersecurity Breach Linked to Scattered Spider',
'type': 'Data Breach'}