Aflac network intrusion attributed to social engineering
Aflac's Form 8-K of June 20, 2025 said it identified unauthorized access to its US network on June 12 and contained it within hours, without ransomware. Aflac said the attack was caused by a sophisticated cybercrime group as part of a campaign against the insurance industry, and press reports of its statement said the intruders used social engineering to gain access. In December 2025 Aflac said personal information of about 22.65 million people was involved, including Social Security numbers and health information.
- Victim
- Aflac
- Industry
- Insurance
- Country
- United States
- Intrusion began
- Jun 12, 2025
- First disclosed
- Jun 20, 2025
- Actor
- Extortion group
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 22.6 million (About 22.65 million people (customers, beneficiaries, employees and agents), per Aflac's December 2025 update.)
- Disclosed cost
- Not disclosed
The identity lesson
Social engineering of staff was enough to reach claims and health data at scale. Phishing-resistant MFA and strict verification before credential or MFA changes are the controls for this insurance-sector campaign.
Sources
- Aflac Incorporated Form 8-K, U.S. Securities and Exchange Commission, Jun 20, 2025
- Aflac Reports Potential Leak of Personal Data in Breach, Claims Journal, Jun 20, 2025
- Aflac hack may have exposed data of 22.6M people, company says, Atlanta Journal-Constitution, Dec 24, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Allianz Life customer data taken from a cloud CRM via social engineering 2025 · Credential phishing
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
Cite this record
SWI Community Team. (2026). Aflac network intrusion attributed to social engineering. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-aflac-social-engineering/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.