US insurance giant Aflac says hackers stole personal and health data of 22.6 million

In a significant cybersecurity incident, Aflac, the prominent U.S. insurance company, has revealed that hackers gained access to sensitive personal data belonging to approximately 22.65 million individuals. This alarming disclosure comes after the company initially reported the breach in June without providing specific figures on the number of affected customers. The compromised information includes critical details such as names, birth dates, home addresses, government-issued identification numbers—like passports and state IDs—driver's license numbers, Social Security numbers, and vital health insurance records. Aflac made this announcement through a filing with the Texas attorney general, highlighting the extensive nature of the data theft. According to a related filing with the Iowa attorney general, Aflac indicated that the culprits behind this breach may have ties to a recognized cybercriminal organization. Experts from federal law enforcement and third-party cybersecurity firms have suggested that this group was specifically targeting the insurance sector, raising concerns about a broader trend in cyberattacks on financial institutions. One group of interest is Scattered Spider, a collective primarily composed of young, English-speaking hackers, which was reportedly active in the insurance industry during the time of the breach. While Aflac has not confirmed the specific group involved, the circumstances align with the nature of their operations. Aflac, which serves around 50 million customers according to its official website, is among several insurance firms that have suffered data breaches recently, including Erie Insurance and Philadelphia Insurance Companies. This incident underscores the increasing vulnerabilities within the insurance industry to cyber threats.