What happened
Aflac detected suspicious activity on a limited number of systems on 12 June 2025 and disclosed the incident on 20 June, saying it was part of a cybercrime campaign against the insurance industry and that no ransomware was involved. The company later confirmed roughly 22.65 million individuals were affected, including customers, beneficiaries, employees and agents, with exposed data spanning names, Social Security numbers, dates of birth, driver's licence and government ID numbers, claims data and health information.
How the deception worked
Aflac has not published the intrusion mechanics beyond describing a sophisticated cybercrime group and an industry-wide campaign, so the vector here is characterised from the campaign rather than from Aflac's own disclosure. Google Threat Intelligence, warning insurers during the same weeks, told the sector to pay particular attention to social engineering attempts against help desks and call centres, the route the same crews had used against retail and hospitality: a phone call impersonating staff to obtain credential or MFA resets, then rapid data collection with no malware deployed.
AI involvement · No AI reported
No public reporting attributes AI-generated voice to the Aflac intrusion.
The control that would have caught it· our reading, not a claim from the sources
Identity verification standards for help desks and call centres, applied to both employee and customer channels, is the control the sector was explicitly warned to strengthen.
Sources (5)
- Aflac discloses breach amidst Scattered Spider insurance attacksBleepingComputer·bleepingcomputer.comOpen ↗
- 22M Affected by Aflac Data BreachSecurityWeek·securityweek.comOpen ↗
- Aflac confirms June data breach affecting over 22 million customersSecurity Affairs·securityaffairs.comOpen ↗
- Aflac Data Breach: PHI of At Least 13.9 Million Individuals CompromisedThe HIPAA Journal·hipaajournal.comOpen ↗
- 3 key takeaways from the Scattered Spider attacks on insurance firmsBleepingComputer·bleepingcomputer.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.