Aflac reported a cyberattack by a sophisticated criminal group focused on the insurance industry. The company confirmed that its systems remain fully operational and customer services have not been interrupted, according to BestWire.
The attackers gained access using social engineering methods. Aflac stated it detected the suspicious activity within hours and immediately stopped the attack.
The company engaged a leading third-party cybersecurity firm to assist in the response and has launched a full review of potentially accessed data.
The files that may have been involved include sensitive information such as claims records, health data, Social Security numbers, and other personal details.
Aflac said the number of individuals potentially affected remains unknown until the file review is completed.
In response, Aflac has established a call center and is offering free credit monitoring and identity theft protection services to individuals who may be impacted.
This incident adds to a growing list of cyberattacks targeting insurers. On June 8, Erie Insurance experienced a network outage and confirmed it was the result of a sophisticated cyber event. Approximately 10 days after the disruption, the company publicly acknowledged the incident.
Shortly after Erie’s disclosure, Philadelphia Insurance Cos. also took systems offline following the detection of unusual network activity.
The company reported that it is cooperating with law enforcement as part of an ongoing investigation into the intrusion.
A representative from Aflac communicated to Reuters that the characteristics of the breach bear a resemblance to the patterns associated with Scattered Spider, a cybercrime entity that has been active since May 2022.
This group is known for targeting several companies within a particular industry in a sequential manner.
Aflac has enlisted third-party cybersecurity experts to aid in the response and investigation.
While the inquiry is still in its early stages, it has been revealed that the breach was facilitated by social engineering tactics that allowed unauthorised access to the network (see SEC Cyberattack Rule Raises Insurance Claims & Risks).
The ongoing examination of potentially impacted files is crucial as these files may contain a range of personal data including claims and health information, social security numbers and other personal identifiers.
The full scope of the breach and the total number of individuals affected are yet to be ascertained.
Aflac has initiated a provision of free credit monitoring and identity theft protection services for a duration of 24 months.
