INSIGHTS
Aflac, 22.65 million people: when the insurer is the target
On 12 June 2025 Aflac contained within hours an intrusion that had already taken health and claims data on 22.65 million people, as Google warned that Scattered Spider had moved to insurance. The analysis: containment and breach, the sector as a target, help desks and agents, questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, June 2025 · by cybercoverinsurance
On 12 June 2025 Aflac, one of the largest US insurers of supplemental health and life policies, detected unauthorised access to its network. The intrusion was contained within hours, with no ransomware and no business interruption, but on the same day the attacker had already copied data. At the end of 2025 Aflac began notifying 22.65 million people. In the same week Erie Insurance and Philadelphia Insurance Companies suffered system outages, and Google warned that the Scattered Spider group had moved from retail to insurance.
For cyber underwriters the case is twofold: it concerns an insured in financial services and, at the same time, the insurance sector as a target. It shows that fast containment does not reduce the claim if the data has already left, and that a sector full of health and claims data attracts attackers who pick one sector at a time.
What is known
The incident. In its Form 8-K of 20 June Aflac wrote that on 12 June it identified unauthorised access to its US network and contained the intrusion within hours. Its systems were not affected by ransomware, and underwriting, claims and customer service continued as normal. The potentially affected files contain claims information, health information, Social Security numbers and other personal data of customers, beneficiaries, employees and agents (Aflac, Form 8-K).
Notifications. At the end of 2025 Aflac said it was notifying 22.65 million people. In August it had filed a report with the federal health regulator using a placeholder estimate of 500 people. Aflac offers 24 months of credit monitoring and identity and medical fraud protection, and says it is not aware of fraudulent use of the data. About two dozen class actions have been consolidated in a federal court in Georgia, alleging negligence, breach of implied contract and unjust enrichment (GovInfoSecurity).
Attribution. Aflac has not commented publicly on the perpetrator. Researchers pointed to Scattered Spider, but NCC Group notes that the group works with others, such as ShinyHunters, which makes definitive attribution difficult (GovInfoSecurity).
The sector. On 16 June John Hultquist of Google Threat Intelligence said the group, after retail in the UK and the US, was hitting insurance, and that insurers should be on high alert for social engineering aimed at help desks and call centres. Erie Insurance had reported an outage affecting all systems on 8 June, with unusual activity seen from 7 June. Philadelphia Insurance Companies shut down phones, email and online applications after an alert on 9 June. The link between these two cases and Scattered Spider was not confirmed (The Register).
What is not known. Aflac has not disclosed the costs of the incident or any insurance recoveries. How the attacker got in has not been disclosed.
Contained in hours, a full claim
Speed saved the business, not the data. Aflac stopped the intrusion within hours and had no business interruption. But the data had been taken the same day (GovInfoSecurity). For the policy, the dominant item is not interruption but the breach: notifications to more than 22 million people, two years of monitoring, defence in dozens of lawsuits.
The number comes late. Months passed between the placeholder report of 500 people in August and the figure of 22.65 million in December. For underwriters, the reserve on a data breach claim should be built on the full set of reachable data, not on the first estimate disclosed.
Health data weighs more. Claims and health information carry specific notification duties and a higher litigation risk. A health insurer, like a hospital, holds the most expensive data to lose.
The insurer as a target
One sector at a time. According to Google, the same group moved from retailers to insurers (The Register). After Marks & Spencer, Co-op and Harrods in April and May, insurers came in June. For a portfolio, aggregation by actor means a whole sector can be hit within a few weeks.
The call centre is the door. Insurers have large call centres, agent networks and help desks that reset credentials for thousands of external users. These are exactly the points Google flagged. The guidance suggests verifying callers by video call or challenge questions and using phishing-resistant multi-factor authentication (The Register).
Agents widen the perimeter. The people affected at Aflac include agents. A distribution network of independent intermediaries with access to the company's systems is a perimeter that is hard to control. For those insuring carriers and intermediaries, the access rights of the agency network are an underwriting issue.
What it means for those insuring the sector
The exposure is in the portfolio and on the balance sheet. Insurers covering other carriers and intermediaries have in their book a sector that was an announced target. The same insurers, as companies, are exposed to the same actor. The claim can come from both sides.
Lawsuits follow notification. The class actions against Aflac also seek measures such as a ban on storing sensitive data in cloud databases (GovInfoSecurity). Data breach lawsuits do not only seek damages, they also impose remediation costs that policies usually do not cover.
What to bring to renewals
Impact for insurersHigh
An intrusion contained within hours at an insurer led to the theft of health and claims data on 22.65 million people, in a campaign aimed at the whole insurance sector.
On the portfolio side, the case suggests monitoring warnings about groups that switch sectors and treating carriers and intermediaries as a group exposed to the same actor in the same period. For a cyber insurer that also insures other carriers, checking its own help desk procedures is part of managing portfolio risk.