Loading story…
Aflac, the largest U.S. supplemental health insurance provider, has notified 22.65 million individuals that their sensitive health and personal information, including Social Security numbers, may have been compromised in a major data breach that occurred in June 2025. The incident, which Aflac described as part of a "sophisticated cybercrime campaign" targeting the insurance industry, is expected to be the largest health data breach reported to U.S. federal regulators in 2025 once official numbers are updated on the Department of Health and Human Services' HIPAA Breach Reporting Tool.
Security researchers have speculated that the cybercriminal group Scattered Spider may be responsible for the attack, which coincided with similar incidents affecting other large U.S. insurers. Aflac initially reported the breach to the HHS Office for Civil Rights with a placeholder estimate of 500 affected individuals, but the updated figure of 22.65 million significantly increases the scale and impact of the incident. The breach highlights ongoing threats to the insurance sector and the potential for large-scale exposure of sensitive health data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Aflac began notifying 22.65 million individuals that their data may have been compromised in the June 2025 attack. The company offered two years of credit monitoring, identity protection, and related fraud protection services, and said it had not observed fraudulent use of the data.
Following the breach, about two dozen class action lawsuits were filed against Aflac and later consolidated in Georgia federal court. The suits allege negligence and seek damages as well as security-related injunctive relief.
The incident resulted in the potential compromise of sensitive information including names, contact details, claims data, health information, Social Security numbers, and other personal data. Security researchers suspected possible links to Scattered Spider, but Aflac did not confirm attribution.
In June 2025, Aflac discovered a cyberattack involving data theft and said it contained the incident within hours. The attack did not involve ransomware, and Aflac's systems remained operational.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aflac disclosed that an unauthorized third party accessed certain systems at **Aflac Life Insurance Japan Ltd.** between June 15 and June 25, leading to a data breach affecting its policyholder portal and related services. The company said the incident was discovered on June 25, after which it contained parts of the intrusion, suspended some systems, and notified the Japan Financial Services Agency and other relevant authorities while continuing policyholder services where possible. Aflac said roughly **4.38 million** customers and agents were likely affected, with exposed information including names, addresses, phone numbers, dates of birth, gender, security information, and insurance account details. The insurer also said premium transfer bank account information for about **230,000** people was exfiltrated, though no credit card data was accessed; at least five Japan services were disrupted, restoration timelines remain unclear, and the company said the breach was limited to Japan systems and did not affect its U.S. business.
Jul 2, 2026
Several major organizations in the healthcare and insurance sectors have disclosed significant data breaches affecting millions of individuals. ARC Community Services reported a ransomware attack by the INC Ransom group, resulting in the exfiltration of sensitive patient data, including health and financial information. Aflac confirmed that a June cyberattack led to the theft of files containing insurance claims, health data, and Social Security numbers for over 22 million customers, with no operational disruption but widespread exposure of personal information. The Louisiana Office of Student Financial Assistance (LOSFA) notified students of unauthorized access to its systems, exposing names and Social Security numbers, though certain savings accounts were not affected. Oklahoma Spine Hospital agreed to a $1.1 million settlement following a July breach that compromised the data of nearly 39,000 patients, including medical and financial details. These incidents highlight the ongoing threat posed by cybercriminals targeting sensitive data in the healthcare and insurance industries. Victims in these breaches are being offered credit monitoring and identity protection services, and regulatory notifications have been issued. The attacks have prompted legal action, regulatory scrutiny, and, in some cases, leadership changes within affected organizations. Law enforcement and cybersecurity experts have been engaged to investigate and mitigate the impact of these breaches, which are part of a broader trend of targeted attacks against organizations handling large volumes of personal and health-related information.
Jun 29, 2026
Aflac Life Insurance Japan disclosed that an unauthorized third party accessed its systems between June 15 and June 25, exposing data tied to about **4.38 million customers**. The company said the compromised information included names, dates of birth, addresses, phone numbers, policy coverage details, and data related to insurance representatives and commercial agencies; roughly **230,000 records** also contained bank account information. Aflac said the incident was limited to its Japan operations, that U.S. business systems were not accessed, and that affected systems were suspended after the intrusion was discovered on June 25. The breach adds to a broader pattern of cyber incidents affecting Japanese organizations, where public reporting has shown hundreds of ransomware and extortion-related cases and frequent abuse of internet-facing systems such as VPN appliances and RDP. Research on disclosed incidents involving Japanese firms found that attackers often move quickly to leak or weaponize stolen data and increasingly time disruptive actions for nights or weekends, underscoring the operational pressure facing defenders. Aflac said it has brought in third-party cybersecurity experts and notified Japan’s Financial Services Agency and police, while stating that no confirmed misuse of the stolen data had been identified at the time of disclosure.
Jul 7, 2026