Insurance giant Aflac has disclosed a data breach after attackers accessed its Japan subsidiary’s systems and made off with personal and bank account information.
The company, a Fortune 500 firm and the largest supplemental insurance provider in the U.S., revealed in an SEC filing that the unauthorized access occurred between June 15 and June 25. Aflac Japan discovered the intrusion on June 25 and immediately suspended certain systems to contain it.
What was taken? Policy and coverage details, personal information, and bank account data. The company says it’s working with external cybersecurity experts and has notified Japanese authorities, including the Japan Financial Services Agency.
There’s a worrying pattern here. Aflac disclosed another breach just one year ago amid a wave of attacks targeting U.S. insurance companies. That earlier incident bore the hallmarks of Scattered Spider — a threat group known for hitting the insurance sector. They’ve also previously partnered with ransomware operations.
The company says this incident is limited to Japan and that U.S. systems were not accessed. But for a company that’s now been breached twice in as many years, that’s cold comfort to policyholders.
Aflac says it will notify affected individuals. The full scope of the incident is still unknown.
