US insurance giant Aflac says hackers stole personal and health data of 22.6 million people

In a significant revelation, Aflac, the prominent U.S. insurance provider, has reported a data breach that has compromised the personal information of approximately 22.65 million individuals. This alarming incident, first disclosed in June, involved the theft of sensitive customer details, including Social Security numbers and health records. On Tuesday, the company confirmed that it has started notifying the affected individuals about the breach. According to a filing with the Texas attorney general, the compromised data encompasses customer names, birth dates, residential addresses, government-issued identification numbers—such as driver’s licenses and passports—and comprehensive health insurance information. Furthermore, Aflac has indicated in a separate filing with the Iowa attorney general that the hackers behind this attack may be linked to a known cybercriminal organization. Federal law enforcement agencies and independent cybersecurity experts have suggested that this group could have been intentionally targeting the insurance sector. The timing of the breach aligns with the activities of Scattered Spider, a loose collective of hackers primarily composed of young, English-speaking individuals who have been focusing on the insurance industry. While Aflac has not confirmed whether this group was directly involved, the connection appears plausible. The company, which boasts around 50 million customers according to its official website, is among several insurers recently victimized by cyberattacks, including Erie Insurance and Philadelphia Insurance Companies. As Aflac navigates this crisis, the implications for affected customers and the broader insurance industry remain to be seen, underscoring the growing threat of cyberattacks in today's digital landscape.