More than 22 million Aflac customers impacted by June data breachMore than 22 million Aflac customers impacted by June data breach

On June 12, 2025, supplemental insurance giant Aflac detected suspicious activity in its U.S. network and contained it within hours. The company disclosed the incident publicly on June 20 in a filing with the Securities and Exchange Commission, saying an intruder had used social engineering to gain access and had stolen files, but that no ransomware was deployed and operations continued normally. Aflac, based in Columbus, Georgia, is the largest provider of supplemental health insurance in the United States and has a large business in Japan, but it said only its U.S. network was affected. The company said it was working with outside cybersecurity experts and expected its review to take several weeks.

The attack came during a spree targeting the insurance sector that security researchers, including Google's threat intelligence team, attributed to Scattered Spider, a loosely organized group of mostly young, English-speaking hackers known for impersonating employees and IT staff on phone calls to obtain passwords and reset multi-factor authentication. Erie Insurance and Philadelphia Insurance disclosed disruptions around the same time.

Aflac spent months reviewing the stolen files. In December 2025 it said the investigation had identified about 22.65 million affected individuals, including customers, beneficiaries, employees and agents. The records included names, addresses and birthdates, Social Security numbers, government ID numbers such as driver's licenses and passports, and medical, insurance and claims information. A filing with federal health regulators covered about 13.9 million people whose protected health information was involved. Aflac offered two years of free identity protection services.

More than 20 class-action lawsuits were filed after the initial disclosure, and state regulators opened inquiries. The breach ranks among the largest affecting a U.S. insurer and among the biggest health-related incidents of 2025, alongside Conduent and Episource. Law enforcement in the U.K. and U.S. arrested several alleged Scattered Spider members during 2025.

The Aflac case shows that even a quickly contained intrusion can have enormous consequences when attackers go straight for data rather than encrypting systems. Social engineering of help desks and staff remains one of the most effective ways into large organizations, which has pushed companies toward phishing-resistant authentication and stricter identity verification for password and device resets.