Aflac announces hackers stole personal data of customers in cyberattack

Aflac, a prominent insurance company in the United States, has reported that hackers stole an undisclosed amount of personal information from its customers during a cyberattack earlier this month. The insurance firm officially disclosed in a mandatory filing with the U.S. Securities and Exchange Commission on Friday that they detected hackers in their system on June 12 and managed to contain the breach. Aflac, known for offering supplementary insurance to individuals with uncovered expenses, revealed that the exact number of affected customers is unknown but that stolen data includes customer claims like Social Security numbers and health details.

Moreover, the breach also compromised data from Aflac’s recipients, employees, and agents. While Aflac confirmed that ransomware did not affect its systems, the company attributed the breach to an unspecified cybercriminal organization with a history of targeting the U.S. insurance sector. According to a statement released on Friday, Aflac stated that the hackers utilized social engineering techniques to infiltrate their network.

A representative from Aflac, who chose not to reveal their identity, declined to respond to inquiries from TechCrunch via email on Monday. Aflac, with roughly 50 million clients as per its official website, becomes the most recent U.S. insurance company to suffer from a cyberattack in recent weeks, amidst reports that cybercriminals are aiming at the broader insurance industry.

Additionally, John Hultquist, the chief analyst at Google’s threat intelligence unit, acknowledged last week that they were investigating multiple breaches in the U.S. that appeared to be linked to Scattered Spider. This group of cybercriminals employs social engineering tactics and, at times, threats of violence to target company help desks and call centers to gain unauthorized access to their networks. Scattered Spider has reportedly been involved in recent intrusions at Erie Insurance and Philadelphia Insurance Companies, both of which disclosed cyberattacks this month, resulting in ongoing disruptions.

Furthermore, the cybercriminals affiliated with Scattered Spider are motivated by financial gains and have previously carried out attacks at prominent tech companies, casinos, and hotels, as well as recent data breaches in the retail sectors of the U.K. and the U.S. The prevalence of cyberattacks targeting insurance companies underscores the urgent need for enhanced cybersecurity measures within the insurance sector to safeguard sensitive customer information and prevent future breaches.