US Insurance Giant Aflac Says Hackers Stole Personal and Health Data of 22.6 Million People

In June, U.S. insurance giant Aflac disclosed a data breach in which hackers stole customers’ personal information, including Social Security numbers and health information. However, the company did not initially reveal the number of customers affected.

On Tuesday, Aflac confirmed it had begun notifying approximately 22.65 million people whose data was stolen during the cyberattack.

In a filing with the Texas Attorney General, Aflac stated that the stolen data includes customer names, dates of birth, home addresses, government-issued ID numbers (such as passports and state ID cards), driver’s license numbers, Social Security numbers, and medical and health insurance information.

Additionally, in a filing with the Iowa Attorney General, Aflac indicated that the cybercriminals responsible for the breach “may be affiliated with a known cyber-criminal organization.” Federal law enforcement and third-party cybersecurity experts have suggested that this group may have been targeting the insurance industry as a whole.

Given that Scattered Spider, a group primarily made up of young English-speaking hackers, was targeting the insurance industry around the time of the breach, Aflac is likely referring to this group.

A spokesperson for Aflac did not respond to TechCrunch’s request for comment.

According to Aflac’s official website, the company serves around 50 million customers.

Aflac was one of several insurance companies targeted in a series of breaches around the same time, with data breaches also occurring at Erie Insurance and Philadelphia Insurance Companies.