Aflac discloses cybersecurity breach, the latest to rattle insurance sector

Insurance giant Aflac Inc. disclosed Friday it suffered a cybersecurity breach as part of a hacking crime spree targeting the insurance industry.

The cyberattack was discovered last week and was stopped within hours, the Columbus-based insurer said. Aflac said its business remains operational and its systems were not affected by ransomware.

It’s unclear whether any customer data, such as Social Security numbers, insurance claims or health information, was stolen during the security breach.

Aflac, a Fortune 500 company that focuses on supplemental health insurance for medical expenses not covered by a primary provider, is the largest victim in a growing cybercrime campaign against the insurance sector.

“This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group,” Aflac said in a statement disclosing the hack.

Two other insurance firms — Erie Insurance and Philadelphia Insurance Companies — suffered similar hacks earlier in June.

An Aflac spokesperson declined to provide further information on the purported cybercrime group aside from affirming it was “a highly sophisticated and well-known group.” CNN reported the trio of insurer hacks are consistent with the techniques of a cybercrime group known as Scattered Spider.

The security breach was discovered June 12 and involved the unauthorized group using “social engineering tactics” to gain access to Aflac’s network, according to preliminary findings from third-party cybersecurity experts the company has hired to investigate the incident.