What happened during the Aflac social engineering cyber attack in June 2025 and what can we learn from it?

Table of Contents

• What happened in the Aflac cyber attack?
• Who was behind the Aflac attack?
• Impact of the breach on Aflac and its customers
• Lessons Learned: What should companies do?
• What experts are saying
• Why social engineering is still a top threat in 2026
• Conclusion

What happened in the Aflac cyber attack?

In June 2025, Aflac, a major U.S. insurance company, was targeted by a social engineering cyber attack. On June 12, the company detected suspicious activity within its network. They quickly activated their incident response plan and managed to contain the attack within a few hours. However, the attacker had already exfiltrated sensitive information, including:

• Social Security Numbers (SSNs)

• Health-related data

• Employee and customer policy details

The attackers did not deploy ransomware, but the data theft alone posed a major threat to customer privacy and company reputation.

Who was behind the Aflac attack?

The attack is believed to be linked to Scattered Spider, a well-known cybercriminal group that has been actively targeting industries like healthcare, aviation, and insurance.

Scattered Spider is notorious for using social engineering tactics, tricking IT support teams or employees into granting access. They often impersonate staff and bypass multi-factor authentication (MFA) protections. Once they get in, they steal sensitive data and sometimes later use ransomware.

Impact of the breach on Aflac and its customers

Although Aflac responded quickly and avoided operational disruption, the attack still had serious consequences:

Lessons Learned: What should companies do?

The Aflac incident highlights the growing speed and sophistication of attackers like Scattered Spider. Unlike traditional ransomware groups that take days to infiltrate and escalate, this group can compromise systems within hours.

Here are some key takeaways for organizations:

1. Train employees against social engineering

• Conduct regular awareness programs.

• Simulate phishing and impersonation attacks.

• Teach employees to verify unusual requests, especially for access.

2. Strengthen IT helpdesk protocols

• Enforce strict identity verification for support tickets.

• Use adaptive authentication and zero-trust principles.

3. Implement real-time threat detection

• Use advanced monitoring tools to catch anomalies early.

• AI-based detection can recognize behaviors typical of insider threats or social engineering.

4. Have an incident response plan ready

• The fast response from Aflac helped limit the damage.

• Always test your incident response and escalation paths regularly.

What experts are saying

“If Scattered Spider is targeting your industry, get help immediately,”
, Cynthia Kaiser, Former Deputy Assistant Director, FBI Cyber Division

This quote stresses the urgency of professional cybersecurity support when dealing with high-level threat actors.

Why social engineering is still a top threat in 2026

In today’s cloud-first, remote-work environment, human error remains the weakest link. Attackers are skipping technical vulnerabilities and going straight to manipulating people. That’s why social engineering is so effective.

Social Engineering Examples:

• Fake IT support calls

• Phishing emails from “HR”

• Fake MFA reset links

• Impersonating a manager via Slack or Teams

 Key Facts about Aflac Cyberattack

Conclusion

The Aflac cyberattack is a wake-up call for the insurance sector and beyond. Even with strong infrastructure, humans are often the entry point for threat actors. Preventing future attacks depends on a combination of employee training, real-time monitoring, and strong authentication controls.

To take this further with guided labs and an instructor, see our our SOC analyst classes.

Related reading

• Why Is the FBI Warning Airlines About Scattered Spider Attacks in 2026? Social Engineering Tactics Explained
• What happened in the Qantas data breach and how were customer profiles exposed?
• What Are the Biggest Cyber Attacks, Ransomware Incidents, and Data Breaches That Happened in June 2025?
• Aditya Birla Capital Digital Gold Hack | ₹1.95 Crore Stolen in API Breach, Services Restored