Aflac says hackers may have stolen customers' personal information

Aflac on Friday said hackers have gained access to its customers personal information in a cybersecurity attack last week.

The company, which provides millions of customers with accident, life and health insurance policies, confirmed the June 12 incident in a statement on Friday, saying it was committed by a "sophisticated cybercrime group" that used "social engineering tactics" to gain access to its network.

While Aflac said it's unable to determine how many people have been affected as of yet, it noted that claims information, health information, Social Security numbers and other personal information were possibly compromised.

The insurer said it stopped the intrusion after identifying suspicious activity on its U.S. network and that its systems were not affected by ransomeware. "We promptly initiated our cyber incident response protocols and stopped the intrusion within hours," the company said.

Aflac is the latest company to be targeted in a recent wave of cybersecurity attacks, which have grown more advanced in recent years. Two insurers, Erie Insurance and Philadelphia Insurance Companies, announced their networks were hacked earlier this month. "This was part of a cybercrime campaign against the insurance industry," Aflac wrote on Friday.

Hackers over the years have expanded their target list to include cities and municipalities, hospitals, hotels and casinos, as reported by CBS News' 60 Minutes. Last year, a cyberattack on UnitedHealth Group cost providers an estimated $100 million a day.

Aflac said it launched an investigation led by third-party cybersecurity experts and is reviewing "potentially impacted files." In the meantime, it is offering customers free credit monitoring and identity theft protection, and Medical Shield for 24 months.

Aflac's business remains operational, the company confirmed. "We continue to serve our customers as we respond to this incident and can underwrite policies, review claims and otherwise service our customers as usual," the company said.

Consumers interested in additional information on the hack, can call Aflac's dedicated call center at 1-855-361-0305, Monday through Friday from 9 a.m. – 9 p.m. EST, Saturday from 9 a.m. – 5:30 p.m. and Sundays from 10 a.m. – 4 p.m. The call center will be available until the end of June.

• Cybersecurity and Infrastructure Security Agency
• Cyberattack