Aflac, the well-known health and life insurance provider, is facing a serious situation after discovering a cyberattack on its U.S. network. This incident may have exposed the personal information of its customers, adding Aflac to the growing list of insurance companies targeted by cybercriminals.
The company identified the breach on June 12 and believes a sophisticated hacking group was behind it. An Aflac spokesperson indicated that the attack shares similarities with the tactics of a group called Scattered Spider. This group has been active since May 2022 and is notorious for launching coordinated attacks against multiple companies within the same industry.
Recently, experts have warned the insurance sector to be vigilant against attacks from Scattered Spider. This group is also linked to recent network outages at other firms, including Philadelphia Insurance Companies and Erie Indemnity. They are known for using identity-based tactics, such as tricking help desks into resetting credentials and bypassing security measures like multi-factor authentication.
Aflac is still in the early stages of investigating the breach. At this point, the company has not disclosed how many customers may be affected or how long the investigation will take. The insurer manages personal and medical data for over 50 million policyholders in the U.S. and Japan. The potential impact of the breach includes exposure of sensitive information like social security numbers and health records.
The company acted quickly to stop the intrusion, claiming it was able to do so within hours. Aflac has also engaged third-party cybersecurity experts to assist with the investigation. Despite this breach, the insurer assures customers that it can continue to provide its services without interruption.
This incident comes on the heels of other significant breaches in the healthcare sector, including a major attack last year on UnitedHealth’s Change unit by a group known as ALPHV, or "BlackCat." As cyberattacks become more common, companies in the insurance and healthcare industries are under increasing pressure to enhance their security measures to protect sensitive customer information.