Cybersecurity Policy Report, Cassidy, Hassan Seek Data Breach ‘Transparency’ From Aflac, (Aug 27, 2025)
Organizations Mentioned:Aflac
Aflac, Inc., is being asked to provide “additional transparency” about a data breach that the health insurance firm disclosed in June.
Sens. Bill Cassidy (R., La.), chairman of the Senate Health, Education, Labor, and Pensions Committee, and Maggie Hassan (D., N.H.) sent a letter to Aflac Chairman and Chief Executive Officer Daniel Amos seeking information “about whether the intruders accessed private consumer and patient data, how Aflac safeguarded protected health information (PHI) prior to the incident, and steps that the company intends to take going forward.”
“Cybersecurity threats pose a substantial risk to the health care system and American patients. Last year, there were over 700 large data breaches that impacted approximately 276 million Americans. These attacks not only cost impacted organizations an estimated $9.77 million per incident but also have led to interruptions in health care, including medication errors and delayed patient appointments,” the senators noted.
They asked Mr. Amos to provide answers to a series of questions by Sept. 5, including whether the company had determined what information was taken and how it intended to strengthen its cyber defenses to prevent future data breaches.
Aflac publicly disclosed the data breach on June 20, about a week after the company discovered it. The company “promptly initiated our cyber incident response protocols and stopped the intrusion within hours,” Aflac said in a news release. It added that the company’s systems “were not affected by ransomware.”
“This attack, like many insurance companies are currently experiencing, was caused by a sophisticated cybercrime group. This was part of a cybercrime campaign against the insurance industry,” it said.
The hackers potentially made off with claims information, health information, Social Security numbers, and other personal information related to customers, beneficiaries, employees, agents, and other individuals, the company acknowledged.
It said it would take time to determine what was taken and how many people were affected, but it offered all customers the opportunity to enroll in identity theft protection services free of charge.
News: FederalLegislation DataBreach DataPrivacy DataSecurity