Cybercriminals Breach Aflac in Widespread Hack on U.S. Insurance Industry

Cybercriminals have breached insurance giant Aflac, potentially stealing Social Security numbers, insurance claims and health information, the company said Friday, the latest in a spree of hacks against the insurance industry.

With billions of dollars in annual revenue and tens of millions of customers, Aflac is the biggest victim yet in the ongoing digital assault on US insurance companies that has the industry on edge and the FBI and private cyber experts scrambling to contain the fallout.

The cyberattack marks the latest in a string of data breaches targeting insurance companies, including attacks earlier this month against Philadelphia Insurance Companies and Erie Insurance.

Aflac said it “stopped the intrusion within hours” after discovering it last week, that no ransomware was deployed, and that it continues to serve its customers.

“This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group. This was part of a cybercrime campaign against the insurance industry,” Aflac said in a statement.

Aflac also mentioned information linked to consumer insurance claims and personal data that could have been compromised during the cybercrime.

“We regret that this incident occurred,” Aflac said. “We will be working to keep our stakeholders informed as we learn more and continue investigating the incident.”

The hackers used “social engineering” to worm their way into its network, according to Aflac. That strategy might entail fooling someone into disclosing security data to provide network access.  Scattered Spider attackers, who pass for tech assistance in order to enter large companies, are infamous for this.

“If Scattered Spider is targeting your industry, get help immediately,” said Cynthia Kaiser, who until last month was deputy assistant director of the FBI’s Cyber Division and oversaw FBI teams investigating the hackers. “They can execute their full attacks in hours.  Most other ransomware groups go in days.

Scattered Spider regularly registers web domains that seem rather much like trustworthy help desks that businesses employ for IT support, the cybersecurity firm Halcyon, where Kaiser currently works, writes in an upcoming study.