Massive Aflac breach exposed millions of SSNs and other data - get free protection today
Attackers stole a trove of sensitive data, including names, contact details, and health information. Affected customers can enroll for free protection by April 18.
SOPA Images / Contributor via LightRocket / Getty Images
Follow ZDNET: Add us as a preferred source on Google.
ZDNET's key takeaways
- An Aflac breach impacted more than 22 million customers.
- Stolen were Social Security numbers and other personal data.
- Aflac is offering free credit monitoring and other services.
Most of us probably know Aflac from the funny quacking duck commercials. But what has happened to millions of the insurer's customers is hardly a laughing matter, especially if you're one of them.
Also: The best data removal services of 2025: Delete yourself from the internet
On June 20, Aflac revealed that it was hit by a cyberattack staged by a sophisticated group as part of a wave of attacks against insurance companies. The firm noted that it became aware of the suspicious activity on June 12. At the time, Aflac said that it would conduct a review of the incident to determine what happened and who was affected.
Now that review has been completed, here are the gory details.
Personal and sensitive data stolen
In its analysis, Aflac found that personal and sensitive data was stolen from some 22.65 million customers, beneficiaries, employees, agents, and others related to the company. The data included names, contact information, claims information, health information, and Social Security numbers. But not all of this data was compromised for everyone affected by the breach.
Though Aflac did not identify the culprit, the attack appears to have been staged by Scattered Spider, a notorious ransomware group that has painted a bullseye on the insurance industry. A July report from cybersecurity provider CrowdStrike revealed how the group uses social engineering, SIM swapping, remote access tools, and other tactics to steal data and hold it for ransom.