Aflac is one of the largest supplemental insurers in the United States. On June 12, 2025, it found an intruder inside its US network and, by its own account, pushed them out within hours. That speed did not stop the theft. Six months later, Aflac confirmed that files touching about 22.65 million customers, beneficiaries, employees and agents had been taken.
No malware or ransomware was deployed. Aflac's preliminary findings said the attacker used social engineering, and the incident matched the playbook of Scattered Spider, a group that gets in by talking to people. This teardown walks the timeline, how that playbook works, what was taken and how to test for the same path before someone calls your help desk.
What CodeAnt AI solves here: CodeAnt AI tests what a single compromised employee identity can reach across apps, APIs, cloud and SaaS. When social engineering hands an attacker a working login, you already know how far it goes and have cut it down.
What Happened in the Aflac Data Breach
The dates below come from Aflac's SEC filings and notices, reporting by CyberScoop and The HIPAA Journal.
Date | What happened |
|---|---|
June 7 and June 9, 2025 | Erie Insurance and Philadelphia Insurance Companies report network incidents. |
June 12, 2025 | Aflac identifies unauthorized access to its US network and says it contains the intrusion within hours. |
June 16, 2025 | Google Threat Intelligence Group warns that Scattered Spider is now targeting insurers. |
June 20, 2025 | Aflac discloses the incident in an SEC filing and says social engineering was used to gain access. |
August 8, 2025 | Aflac reports the breach to HHS with a placeholder count of 500 people. |
December 2025 | Aflac confirms about 22.65 million people were affected and begins notifying them. |
Early 2026 | The HHS breach portal lists at least 13,924,906 people whose protected health information was involved. |
Two numbers circulate for this breach, and both are right. The 22.65 million figure covers everyone whose personal data was involved, and the HHS figure counts only people whose health information was exposed.
What Data Was Exposed
According to Aflac's notification letters, the stolen files covered customers, beneficiaries, employees, agents and others connected to its US business.
Identity data: Names, addresses, dates of birth, Social Security numbers and government ID numbers such as driver's license and passport numbers.
Health data: Medical information, health insurance details and claims information.
For a supplemental insurer, claims files hold diagnoses and treatment details alongside identity data. That combination is what put this breach under HIPAA and onto the HHS breach portal.
The Attack Chain, Technically
Aflac has not published a forensic account of exactly how the attacker got in. What is public is Aflac's own statement that social engineering was used, and the well-documented method of the group the incident matched.
Stage 1. A phone call to the help desk
Scattered Spider's signature move is calling an IT help desk while posing as an employee. According to the joint CISA and FBI advisory on the group, members impersonate staff to get passwords reset or MFA moved to a device they control. The caller usually has the employee's name, title and employee ID from LinkedIn and earlier breaches. The help desk agent hears a stressed colleague who is locked out, which is exactly what help desks exist to fix.
Stage 2. MFA reset, then a valid login
Once the password is reset or a new MFA device is enrolled, the attacker logs in as that employee. Every control downstream now sees a legitimate user. Push-based MFA offers no protection at this stage. The attacker owns the second factor, so every prompt gets approved.
Stage 3. Moving fast to the data
Scattered Spider typically heads straight for identity systems, file shares, SaaS apps and cloud consoles. Aflac said its detection and response caught the intrusion within hours. Hours were enough. The attacker reached files holding claims, health and identity data for millions of people before being cut off.
Stage 4. Exfiltration without encryption
No ransomware ran, and Aflac's operations were never interrupted. The group took data and left, which is quieter and just as damaging for the people in the files. Fast containment protected Aflac's systems, and the data had already left by the time it worked. Detection tuned for encryption and detection tuned for bulk file access are separate controls.
Why Insurers Became Scattered Spider's Target in 2025
Scattered Spider works one sector at a time. After a run of attacks on UK and US retailers in spring 2025, it turned to insurance.
Google's John Hultquist said the group had a history of focusing on one sector at a time and urged insurers to watch for social engineering aimed at their help desks and call centers. Erie Insurance, Philadelphia Insurance Companies and Aflac were all hit within five days.
Insurer | Date reported | Reported impact |
|---|---|---|
Erie Insurance | June 7, 2025 | Network outage and business disruption |
Philadelphia Insurance Companies | June 9, 2025 | Network shutdown affecting phones, email and online applications |
Aflac | June 12, 2025 | Data theft affecting about 22.65 million people, no ransomware |
Insurers make an easy target for this method. Large call centers, distributed agent networks and constant password resets give a convincing caller plenty of cover. The pattern repeated in 2026. Aflac's Japanese subsidiary disclosed a separate incident affecting 4.38 million policyholders that June, a year after the US breach.
What a Real Test Against This Chain Looks Like
The help desk call itself is a people and process problem, best tested through a social engineering exercise. What the stolen identity reaches afterward is a technical problem, and that is where the damage in this breach happened.
Chain link | What the test checks | Evidence it produces |
|---|---|---|
Help desk process | Whether an agent will reset a password or move MFA on a caller's word | Pass or fail on identity verification steps |
Leaked employee data | What an attacker can learn about staff from public and breached sources | The profile a caller would use to sound legitimate |
Post-login reach | What a standard employee account can touch in apps, APIs, SaaS and cloud | A proven path from one account to sensitive files |
Bulk file access | Whether one identity can read or export claims and member files in volume | Records reachable, with sample evidence |
Detection | Whether bulk access by a new session triggers an alert fast enough | Time to detect and contain |
Our guide to IDOR and broken access control covers how one account ends up reading records far outside its job. The McKesson breach teardown shows the same help-desk vishing pattern extending into SaaS and OAuth apps.
Lessons for Insurers and Supplemental Carriers
The Aflac data breach leaves lessons that apply to any insurer running a large help desk or agent network.
Harden help desk identity checks: Require callback to a number on file, manager approval or video verification before resetting passwords or MFA for sensitive roles.
Move to phishing-resistant MFA: FIDO2 security keys and passkeys cannot be approved by a caller the way push prompts can.
Alert on new MFA enrollments: A new device on a privileged account, followed by a login from a new location, should page someone.
Shrink what one account can reach: Least privilege on file shares and SaaS apps limits what a few hours inside can take.
Detect bulk access: Stopping ransomware protects systems. Stopping mass file reads protects the data.
Map it to your regulations: A breach like this triggers HIPAA notification and state insurance data security rules, including the NAIC Insurance Data Security Model Law and NYDFS Part 500.
Our guide to how insurance companies get breached through portals, APIs and vendors covers the other entry points insurers face.
The Legal and Regulatory Fallout
More than 20 class action lawsuits were filed after the breach, and the Senate HELP Committee sent Aflac's CEO a letter asking about the attack in August 2025.
Because health data was involved, the incident sits on the HHS breach portal as one of the largest healthcare breaches reported in 2025. That brings OCR's standard questions about risk analysis and access control, the same ones covered in our guide to HIPAA penetration testing requirements.
How CodeAnt Would Have Caught This
Aflac has not published which account was taken over or which systems the attacker touched. So we won't claim CodeAnt would have prevented this breach.
What CodeAnt measures is the damage one social-engineered login can do.
Gray box testing from a compromised identity: Agents authenticate as a standard employee session and chain what it can reach, including IDOR, broken object level authorization and privilege escalation paths, toward claims and member data.
Exposure of employee data: Reconnaissance surfaces staff credentials and details already circulating on the open internet, the raw material a convincing caller relies on.
Proof with evidence: Each high or critical finding ships with a working proof of exploit, so "what can one account reach" has a demonstrated answer.
Continuous coverage: Testing runs as access and systems change, so a new file share or SaaS integration is tested when it appears.
The walkthrough of how AI penetration testing traces a data leak shows a full chain end to end.
The Fix
Aflac caught the intruder in hours and still lost data on millions of people. The phone call opened the door, and the breadth of one account's access decided how much walked out. Assume a caller will eventually get through. Then prove what that account can reach and shrink it.
Run a free black box scan on one URL to see your exposed surface, then book a walkthrough to see gray box testing chained through to a proven data leak. For the insurance compliance picture, start with our guide to penetration testing for insurance companies.
