Aflac Data Breach Exposes 22.65 Million Individuals' Information

Aflac, the largest U.S. supplemental health insurance provider, has notified 22.65 million individuals that their sensitive health and personal information, including Social Security numbers, may have been compromised in a major data breach that occurred in June 2025. The incident, which Aflac described as part of a "sophisticated cybercrime campaign" targeting the insurance industry, is expected to be the largest health data breach reported to U.S. federal regulators in 2025 once official numbers are updated on the Department of Health and Human Services' HIPAA Breach Reporting Tool.

Security researchers have speculated that the cybercriminal group Scattered Spider may be responsible for the attack, which coincided with similar incidents affecting other large U.S. insurers. Aflac initially reported the breach to the HHS Office for Civil Rights with a placeholder estimate of 500 affected individuals, but the updated figure of 22.65 million significantly increases the scale and impact of the incident. The breach highlights ongoing threats to the insurance sector and the potential for large-scale exposure of sensitive health data.