Don’t Wait for a Breach—Schedule Your Free Security Review

Form/motiva/blogs

What’s Happening

  • Hackers infiltrated Aflac’s U.S. systems on June 12 2025 
  • The attack is part of a coordinated takedown of the insurance industry 
  • Files containing medical claims, SSNs, and personal data were stolen 
  • The number of affected customers is still unknown 
  • Aflac operations remain up—for now—but legal hell is coming 

“This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group. This was part of a cybercrime campaign against the insurance industry,” Aflac has said. 

Targeted Insurance Industry Attacks

Experts believe this breach—along with recent attacks on other insurance companies and carriers—is linked to Scattered Spider, a cybercrime group flagged by Google as one of the most dangerous threats to financial and insurance sectors today.

How They’re Succeeding

Scattered Spider is targeting companies by posing as your internal IT or helpdesk staff. They contact employees via phone, text, or email, pretending to offer support. Their tactics include: 

 

  • Asking for login credentials or one-time passcodes 
  • Sending repeated MFA prompts to get users to click “Approve” (MFA fatigue) 
  • Convincing users to install new remote access tools like TeamViewer or Splashtop 
  • Using fake domain names that look like trusted tools (e.g., Okta, Zoho) 

What the Hackers Got

Here’s what was potentially exposed at Aflac: 

 

  • Medical claim histories 
  • Health records 
  • Social Security numbers 
  • Private data of customers, agents, employees, and beneficiaries 

Aflac still doesn’t know how many people were affected. 

Aflac still doesn’t know how many people were affected

Compliance & Legal Risks

Aflac’s SEC Form 8-K filing signals the breach may have material financial consequences. Regulatory scrutiny is likely, including:

 

  • HIPAA (health data) 
  • GLBA, FTC Safeguards Rule (financial info) 
  • NY DFS Part 500 (New York customers) 
  • CCPA, SHIELD Act, other state privacy laws 
  • PCI DSS, if payment systems were involved 

 

Violations could trigger lawsuits, audits, fines, and major reputational damage. 

What You Would Have To Do If You Were Aflac

If this happened to your Agency, here’s what you’d be dealing with:

 

  • System downtime during cleanup and recovery 
  • Investigation costs in the thousands to tens of thousands 
  • Detailed audit requests from regulators 
  • Fines for each violation, multiplied across state and federal laws 
  • Security remediation and tech control upgrades 
  • Customer notifications in all applicable states 
  • Credit monitoring costs: $100–$200 per person/year for 2–3 years 
  • Long-term loss of trust from your clients 
Compliance

Don’t Wait To Get Ahead Of These Active Threats

Motiva Networks helps independent agencies lock down their systems before cybercriminals lock you out. 

 

Our CEO, Walter, is a Certified Compliance Instructor who specializes in helping agencies get ahead of audits, threats, and regulatory nightmares. 

👉 Schedule your free Cybersecurity Risk Review right now:

Motiva-hour27-7
Walter-Contreras

Walter Contreras

Walter Contreras has over 25 years of experience in information technology, including cybersecurity, with a focus on the Insurance Industry. As both a computer scientist and a graduate of the Columbia University Business School’s Executive MBA program, Walter understands how the world’s digital transformation is impacting small and medium businesses. His mission is to deploy information technology to protect and empower entrepreneurs.

Related blogs