Aflac said its investigation into a cybersecurity incident discovere
d six months ago affected more than 22.6 million individuals.
The Columbus, Georgia-based health and life insurer said
in a statement earlier this month that it has started to notify imp
acted individuals but, to date, it is not aware of any fraudulent use of personal identifiable information and wi
ll continue to monitor the situation. Aflac said it determined on Dece
mber 4 that the files potentially impacted likely contained personal information, triggering notifications.
Aflac in June announced it was investigating a breach on its U.S. network that may have exposed customers’ perso
nal information. The cyberattack was discovered on June 12, and was t
hought to be the work of the cybercrime group known as Scattered Spider.
Soon after Aflac’s announcement, the Google Threat Intelligence Group issued an advisory that Scattered Spid
er appeared to have shifted its focus from retailers to insurers. Erie Insurance and Philadelphia Insuran
Watch More Image Part 2 >>>
ce each reported network outages as well. Erie in July said they had f
ully restored business operations and there was no evidence of a data b
reach. Days prior, Philadelphia said it restored its networks, adding that no ransomware event occurred.
In its latest statement, Aflac reiterated that it launched an immediate investigation with the help of a thir
d-party cybersecurity experts, and it notified federal authorities. The insurer’s customers, beneficiaries, employ
ees, agents, and other individuals related to Aflac were involved. Names, contact information, claims information
, health information, social security numbers, and/or other personal information were potentially accessed.
“Importantly, the security incident was contained within hours; our s
ystems were not affected by ransomware and remained operational,” Aflac said.
Also in June, Aflac was hit with a proposed class-action lawsuit in Ge
orgia federal court. The case is still ongoing. Erie was also hit with two class-action lawsuits related to its cyber incident.