22 Million Affected by Aflac Data Breach

Aflac is notifying roughly 22.65 million individuals that personal information was stolen from its systems in June 2025. The company disclosed the intrusion on 20 June, saying suspicious activity had been detected on its US network on 12 June and attributed the breach to a sophisticated cybercrime group.

The compromised data include names, addresses, Social Security numbers, dates of birth, driver’s licence numbers, government ID numbers, medical and health insurance information, and other data, and Aflac said the breach involved customers, beneficiaries, employees, agents and related individuals.

Aflac is offering 24 months of free credit monitoring, identity theft protection and medical fraud protection to affected individuals, and it said it is not aware of any stolen information having been fraudulently used at this time. The company did not name a threat actor, but described the incident as part of a campaign against the insurance industry; SecurityWeek notes this has led to claims that the Scattered Spider group may have been involved.