Overview

• Aflac detected unauthorized access to its U.S. network on June 12 and says it contained the intrusion within hours under its incident response protocols.
• Attackers leveraged social engineering tactics and are suspected to belong to Scattered Spider, a financially motivated group linked to breaches at other U.S. insurers.
• Potentially exposed files include Social Security numbers, health information and claims data for customers, employees, agents and beneficiaries.
• Aflac confirmed its core systems were not affected by ransomware and remain operational, ensuring uninterrupted policy and claims services.
• The insurer continues its forensic review to determine the full scope of the breach while offering affected parties two years of free protection services.