Aflac, the largest provider of supplemental insurance in the United States, has confirmed a data breach in its US systems earlier this month. The company detected suspicious activity on June 12, 2025, and immediately initiated its cyber incident response protocols, stopping the intrusion within hours. According to Aflac, the attack was carried out by a sophisticated cybercrime group targeting the insurance industry.
The breach is believed to be part of a larger campaign that has also affected Erie Insurance and Philadelphia Insurance Companies. These attacks share similarities with techniques used by Scattered Spider, a group of young cybercriminals known for their aggressive extortion tactics. This group gained notoriety for hacking Las Vegas casinos in September 2023.
Aflac’s investigation, still in its early stages, indicates that compromised data may include claims information, health details, social security numbers, and other personal information related to customers, beneficiaries, employees, agents, and other individuals associated with its US business. The company has expressed regret over the incident and is committed to keeping stakeholders informed as the investigation progresses.
In response to the breach, Aflac is offering free credit monitoring and identity theft protection, along with Medical Shield, for 24 months to affected individuals who contact its dedicated call center. The call center can be reached at 1-855-361-0305, starting from June 20 at 8 a.m. Eastern Time, and will operate on specific hours until the end of June, excluding major US holidays.
