Aflac Detects Cyber Breach, CFOs Urged to Prioritize Cyber Risk Management

Cybersecurity has become a critical concern for Chief Financial Officers (CFOs), especially in light of recent high-profile breaches that have underscored the need for increased vigilance. Aflac, a prominent Fortune 500 company and one of the largest insurance providers in the U.S., announced on Friday that it had detected unauthorized access to its U.S. network on June 12. The compromised files contained sensitive information, including claims, health data, Social Security numbers, and other personal details. Aflac swiftly activated its cyber-incident response protocols and managed to halt the intrusion within hours.

The company is still in the early stages of assessing the incident and has not yet determined the total number of affected individuals. However, Aflac’s operations remain unaffected, and its systems were not impacted by ransomware. According to an SEC filing, Aflac plans to notify regulators and affected customers, offering free credit monitoring and identity theft protection services. The company attributed the incident to a sophisticated cybercrime group involved in a broader campaign targeting the insurance industry. Google’s Threat Intelligence Group identifies this group as Scattered Spider, known for its persistent use of social engineering and direct communications with victims.

John Hultquist, VP of intelligence analysis at cybersecurity firm Mandiant, highlighted the threat, stating that actors with the hallmarks of Scattered Spider are now targeting the insurance industry. He warned that these actors have a habit of working their way through a sector, advising insurance companies to be on the lookout for social engineering schemes targeting their call centers. The rising cost of cyber risk, particularly in the U.S., has made it imperative for CFOs to integrate cyber-risk management with financial oversight. The average cost of a data breach in the U.S. was $9.36 million in 2024, the highest among the countries and regions studied. This necessitates CFOs to quantify these risks and estimate the cost of incidents by collaborating closely with chief information security officers.

By understanding risk probability and exposure, setting spending and ROI metrics, and communicating recommendations for prioritizing cybersecurity investments, CFOs can better manage these risks. Geopolitical complexities further exacerbate the threat landscape. Federal officials caution that pro-Iranian hacktivists or state-sponsored groups could target vulnerable U.S. networks, creating a heightened threat environment. Hultquist expressed concern about cyber espionage targeting U.S. leaders and surveillance facilitated by compromises in various sectors where data could be used to identify and physically track people of interest. He emphasized the need for vigilance without overhyping the threat, highlighting the practical risks to enterprises.

In summary, the recent cyberattacks on insurers have put CFOs on high alert, underscoring the need for robust cybersecurity measures. The integration of cyber-risk management with financial oversight is crucial for CFOs to quantify risks and estimate the cost of incidents. The geopolitical complexities and the rising cost of cyber risk further emphasize the importance of vigilance and proactive measures in managing cyber threats.