Aflac Breach Unravels Massive Cybercrime Wave Striking Insurers

Aflac Breach Unravels Massive Cybercrime Wave Striking Insurers

At a glance

• Aflac found suspicious activity on its U.S. network on June 12, 2025, and said it stopped the intrusion within hours.
• A cybercrime group used social engineering to get in; investigators said the attack matched the methods of Scattered Spider, though the attackers did not identify themselves.
• Erie Insurance and Philadelphia Insurance Companies reported attacks in the same month, part of a campaign aimed at insurers.
• Files at risk include claims and health information, Social Security numbers and other personal data.

Aflac is the biggest insurer hit so far

Aflac disclosed on June 20, 2025, that a “sophisticated cybercrime group” had broken into its U.S. network. No ransomware was involved, the company said, and it kept serving customers throughout. It is the largest victim so far in a run of attacks on U.S. insurers that month.

How the attackers got in

Aflac said its preliminary findings showed the intruders used social engineering. In a later notice to state regulators it said they got into one or more user accounts and reached a limited number of systems on June 12, the same day the activity was detected and contained. The files under review contain claims information, health information, Social Security numbers and other personal information about customers, beneficiaries, employees and agents. The count of affected people was not yet known.

A campaign against the insurance sector

Google’s threat intelligence team had already warned that Scattered Spider was going after insurers. People familiar with the Aflac case told reporters the attack fit the group’s playbook. That playbook is simple. Its members pose as employees and talk help desks into resetting passwords. Erie Insurance and Philadelphia Insurance Companies were hit in the days before Aflac and suffered network outages.

What insurers are doing now

The attackers go after people, not software flaws. So the fixes are procedural: tighter help desk identity checks, stricter password reset rules and closer control of who can enroll a new multi-factor device. Zero-trust controls that limit what a single stolen account can reach are getting a second look too.

Help for affected customers

Aflac offered anyone who contacts its call center 24 months of free credit monitoring, identity theft protection and Medical Shield. The company brought in outside cybersecurity experts and notified federal law enforcement.

Anyone who gets a notice should watch their accounts and medical statements. Be wary of calls or emails that mention the breach.

Why help desks are now the front line

Aflac’s attackers got in without exploiting any software bug. For insurers, the lesson is to treat the help desk and identity checks as security controls. That is where this campaign started.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.