Aflac Targeted in Coordinated Insurance Industry Cyberattack
On June 12, 2025, Aflac detected unauthorized activity on its U.S.
Key points
- Unauthorized activity detected on Aflac's U.S. network on June 12, 2025.
- Part of a broader cybercrime campaign targeting the insurance sector.
- Attack attributed to a sophisticated social-engineering method, likely by Scattered Spider.
Connected intelligence
Signal brief
Follow the organization, likely method and potential impact to explore connected Shadow Tier intelligence.
- Published
- Jun 12, 2025
- Updated
- Jun 26, 2026
- Confidence
- Medium
- Evidence
- 2 sources
Structured assessment
Signal analysis
This analysis groups the signal by industry, likely incident action and impacted security area.
Threat source
Watch exposure paths that could affect data, operations or third-party trust.
Business impact
- Impact area
- Unknown
Mentioned entities
Quick context
Questions about this signal
What happened in this signal?
On June 12, 2025, Aflac detected unauthorized activity on its U.S. network, part of a broader cybercrime campaign targeting the insurance sector. The breach, attributed to a sophisticated social-engineering attack likely by the Scattered Spider cybercrime group, was swiftly contained. Preliminary findings indicate potential exposure of sensitive data including claims details, health records, Social Security numbers, and personal information tied to customers, agents, and employees.
When was this signal reported?
Shadow Tier lists Jun 12, 2025 as the signal date.
Which organization is connected to this signal?
Aflac is the organization connected to this public signal.
Explore AflacWhich sector context is relevant?
This signal is connected to insurance cybersecurity intelligence.
Explore insurance cybersecurity intelligenceRelated signals
Compare shared topics, actors and incident patterns before opening the full signal.
Aflac Life Insurance Japan Suffers Cybersecurity Breach Exposing Policyholder Data
Aflac Life Insurance Japan disclosed unauthorized access to its systems between June 15 and June 25, 2026. The breach affected files containing policy details, personal information, and bank account information of approximately 4.38 million customers. The company has suspended affected systems and is investigating the incident with third-party cybersecurity experts.
Related context
Qualtrics users impacted by Canvas (Instructure) nationwide data breach
A widespread security incident affecting Canvas, a learning management system by Instructure, impacted thousands of institutions, including Rutgers University, which utilizes the Qualtrics survey tool. Instructure notified Rutgers that while there was no indication of passwords, dates of birth, government identifiers, or financial information being involved, the specific Rutgers data compromised remains unclear. Instructure reportedly reached an agreement with the unauthorized threat actor, and the stolen data was returned and destroyed. Canvas remained operational throughout the incident.
Related context
Suno AI Music Generator Data Leak
A data leak at the AI music generator Suno, which occurred in November 2025, became public in July 2026. The breach exposed data from over 55 million unique email addresses and, for users who registered with their phone numbers, those numbers as well. A small portion of the dataset also included payment processor Stripe data, leading to the leak of names, physical addresses, purchase amounts, and certain credit card details (card type, expiration date, and last four digits) for tens of thousands of users. Suno confirmed it does not have access to full credit card numbers via Stripe.
Related context
SR Bancorp's Internal Audit Provider, Mercadien, Experiences Data Security Incident
Mercadien, P.C. CPAs, an internal audit service provider for SR Bancorp and Somerset Regal Bank, reported a data security incident on July 10, 2026. An unauthorized actor accessed and acquired files from Mercadien's servers containing sensitive customer data belonging to Somerset Regal Bank. The compromised data included customer names, Social Security numbers, account numbers, identification documents, and dates of birth. Importantly, SR Bancorp confirmed that its own business systems, payment systems, customer access to accounts, and core information technology infrastructure were not affected by the incident. The bank is coordinating with Mercadien to provide notifications to affected customers as required by federal and state laws and regulatory guidance. While the incident exposes customers to potential identity theft and fraud, SR Bancorp currently assesses the financial impact as immaterial to its consolidated financial condition or results of operations. This incident highlights the significant risks associated with third-party vendors handling sensitive customer information.
SR Bancorp Discloses Data Security Incident at Internal Audit Provider Mercadien, Exposing Somerset Regal Bank Customer Data
SR Bancorp, Inc. reported a data security incident on July 10, 2026, involving its internal audit service provider, Mercadien, P.C. CPAs. An unauthorized actor accessed and acquired files from Mercadien's servers that contained sensitive customer data belonging to Somerset Regal Bank. The compromised information included customer names, Social Security numbers, account numbers, identification documents, and dates of birth. Importantly, SR Bancorp confirmed that the bank's own business systems, payment systems, customer access to accounts, and core information technology infrastructure were not directly impacted or disrupted by this incident. The company is coordinating customer notifications through Mercadien as required by applicable federal and state laws and regulatory guidance. While the incident exposes SR Bancorp to regulatory notification requirements, reputational risk, and potential legal liability, the company has initially assessed the financial impact as immaterial to its consolidated financial condition or results of operations. However, this assessment could change if the data is published or misused, or if further cybersecurity incidents occur. This event highlights the inherent risks associated with third-party vendors handling sensitive customer information.
Related context
U.S. Insurance Provider AssuranceAmerica Discloses Data Breach Affecting 6.9 Million People
U.S. insurance provider AssuranceAmerica confirmed a data breach affecting the personal information and driver's license numbers of 6.9 million people. The company discovered hackers in its computer systems on March 17, 2026, and concluded its investigation on June 15, 2026, with notification letters scheduled to be sent out on July 10, 2026.
Related context