Aflac Data Breach: More Than 22.6 Million Individuals Affected
The scale of a June 2025 Aflac data breach has recently been confirmed – more than 22.6 million individuals are now known to have been affected. Aflac, a Fortune 500 company that provides health and life insurance policies, including supplemental health insurance to cover medical costs not covered by an individual’s primary health insurer, experienced a cyberattack on June 12, 2025.
The attack was detected the same day and was contained within hours, without any file encryption. Despite the rapid detection and remediation, the hackers gained access to systems containing data relating to customers, beneficiaries, employees, agents, and other individuals connected to Aflac. When the incident was first announced, Aflac had yet to confirm the extent of the data breach or the types of information involved. The data review has recently been completed, and it has been confirmed that names, addresses, dates of birth, Social Security numbers, government-issued ID numbers (e.g., passport/state ID card numbers), driver’s license numbers, medical information, and health insurance information were compromised in the incident.
Aflac had previously said the attack was conducted by a third party that may be affiliated with a known cyber-criminal organization, and that the attack involved social engineering of employees. While not stated by Aflac, the attack is widely believed to have been conducted by the Scattered Spider cybercrime collective, which was targeting the insurance industry at the time and often gains initial access through social engineering. Other insurance companies attacked by Scattered Spider over the summer include Erie Insurance, Philadelphia Insurance, and Allianz Life.
Aflac has offered the affected individuals 24 months of credit monitoring and identity theft protection services and started issuing individual notification letters earlier this month. Aflac said it is unaware of any misuse of the affected data but has advised the affected individuals to remain vigilant against identity theft and fraud.
The HHS Office for Civil Rights breach portal still lists the data breach with the original placeholder estimate of at least 500 affected individuals. Aflac said the data breach affected 22.65 million individuals globally. It has yet to be confirmed how many of the affected individuals are located in the United States; however, the Aflac data breach is likely to rank as one of the largest healthcare data breaches of the year.
