On June 20, 2025, major insurance company Aflac disclosed that it had experienced a cyber incident within its network. Although the company confirmed that it identified and resolved the incident in a matter of hours and remained operational throughout, various types of sensitive stakeholder files (e.g., claims data, health history, Social Security numbers, and personal contact information) were potentially compromised during this time frame. Continue reading to learn more about these alarming cyberattacks.
Contact us today for additional industry updates and risk management resources at 909.466.7876. Also, check out the 5 Cybersecurity Mistakes That Could Cripple Your Business
This incident marks the third large-scale cyberattack in the last few weeks targeting a U.S. insurance company. Each attack involved some degree of advanced social engineering tactics and ransomware; according to reports from Google Threat Intelligence, this indicates a connection to the well-known cybercrime group Scattered Spider.
In the days since Aflac reported the incident, cybersecurity experts have voiced concern over the possibility of a continued attack spree across the insurance industry, urging financial and underwriting businesses to be on “high alert.” This article provides more information on recent cyber incidents linked to Scattered Spider and outlines the next steps for businesses in the insurance sector.
Scattered Spider History
Scattered Spider, which consists of experienced hackers across the United States and Europe, is believed to have first formed in 2022. These hackers are known for leveraging sophisticated phishing scams and multifactor authentication exploits to launch disruptive ransomware attacks.
Since its inception, the cybercrime group has been tied to several attacks on high-profile organizations worldwide. Scattered Spider generally focuses on a single industry at a time, attacking a series of businesses in the same sector for an extended period. In 2023, the group was assumed responsible for cyber incidents impacting multiple Las Vegas hotels and casinos operated by Caesars Entertainment and MGM Resorts.
During the first half of 2025, the group was connected to two different system outages among global retailers: Marks & Spencer and Co-op in April and Victoria’s Secret in May. In recent weeks, Scattered Spider appears to have shifted its focus to the U.S. insurance industry, being linked to cyberattacks on Philadelphia Insurance Companies and Erie Insurance before the Aflac incident.
Next Steps After These Cyberattacks
In light of these developments, businesses in the insurance sector should be prepared for a possible influx of social engineering attempts and ransomware attacks. Businesses should closely monitor their threat detection systems to swiftly identify unusual network activity and instruct employees, especially those working at help desks and call centers, to diligently watch for and report suspected phishing scams. In addition, businesses should review their cyber incident response plans to promote prompt remediation efforts following an attack.
