Aflac's 2025 breach exposed the protected health information of 13,924,906 people, according to the company's own filing with the US Department of Health and Human Services' Office for Civil Rights. For historical context, HHS reported that the earlier Anthem breach exposed almost 79 million people. It was not an isolated incident. Five more carriers and administrators disclosed breaches of their own in the same 18-month stretch, while the industry's own model regulation still leaves half the country without a state-level requirement that insurers run a formal cybersecurity program.
How many records were exposed in insurance-sector breaches recently?
Six confirmed breaches at insurance carriers and administrators exposed the personal or health data of more than 28 million people combined between May 2024 and March 2026. Aflac's breach alone accounts for roughly half that total, and every incident on the list involved a named insurer, not a downstream vendor with no consumer-facing brand.
Figure 1: Selected confirmed insurance-sector data breaches, 2024 to 2026, by number of individuals affected. Sources: HHS Office for Civil Rights, company SEC and state AG filings, cybersecurity trade press (see Sources section).
Aflac's intrusion occurred on June 12, 2025, and the company attributed initial access to social engineering, later linked by researchers to the Scattered Spider group, which has repeatedly targeted the insurance industry through help-desk impersonation rather than technical exploits. AssuranceAmerica's March 2026 breach followed a similar pattern: an attacker targeted a single employee to gain access to the company's IT department, then copied data files affecting more than 6.9 million customers. Farmers Insurance's May 2025 breach traced back to a third-party vendor tied to its Salesforce systems, exposing 1,071,172 people's names, driver's license numbers, and partial Social Security numbers.
Not every entry on the list is a hack in the conventional sense. Blue Shield of California's 4.7 million-person exposure was a misconfiguration: the insurer connected Google Analytics to Google Ads on its member portal from April 2021 through January 2024, inadvertently sharing health plan details, claim dates, and "Find a Doctor" search terms with Google's ad platform. Blue Shield has said no bad actor was involved and that Social Security numbers and financial details were not exposed, but the incident still counts as a reportable breach under HIPAA and appears on the HHS breach portal as the second-largest healthcare-related disclosure of 2025. It fits a pattern seen well beyond insurance: hotel and travel companies disclosed similarly large breaches in the same window, often through the same class of third-party vendor exposure.
Why do insurers keep getting breached?
Verizon's 2025 Data Breach Investigations Report recorded 3,336 security incidents and 927 confirmed data breaches across the Financial and Insurance sector, one of the report's most heavily represented industries. Two structural factors explain why: insurers sit on some of the richest personal-data troves of any industry, spanning health records, financial account numbers, driver's license numbers, and Social Security numbers in a single customer file, and much of that data flows through third-party administrators, claims vendors, and SaaS platforms that sit outside the carrier's own security perimeter.
Figure 2: Security incidents versus confirmed data breaches in the Financial and Insurance sector. Source: Verizon 2025 Data Breach Investigations Report.
Social engineering is the common thread across the largest 2025-2026 carrier breaches. Aflac, AssuranceAmerica, and Farmers Insurance were each compromised through an attacker manipulating a person or a downstream vendor rather than exploiting unpatched software, a pattern researchers have tied to loosely affiliated groups including Scattered Spider and ShinyHunters. Coalition's 2026 Cyber Claims Report found that business email compromise and funds transfer fraud together made up 58% of the cyber incidents its insured businesses reported in 2025, more than ransomware, and that 52% of funds-transfer-fraud claims originated from a business email compromise. If your business collects any of the data types insurers handle, health information, payment details, or government ID numbers, disclosing exactly what you collect and how it is protected in a current privacy policy is one of the few controls a small business can put in place without a security budget: you can generate a privacy policy that covers sensitive data categories and breach-notification commitments.
Which states require insurers to run a cybersecurity program?
Only 28 of the NAIC's 56 member jurisdictions had adopted the Insurance Data Security Model Law (MDL-668) as of the National Association of Insurance Commissioners' August 2025 legislative brief, according to Akin Gump's review of that filing. MDL-668, first adopted by the NAIC in 2017, requires licensed insurers to run an annual written risk assessment, maintain a documented information security program, and notify the state insurance commissioner within 72 hours of discovering a qualifying cybersecurity event.
Figure 3: NAIC Insurance Data Security Model Law (MDL-668) adoption across the NAIC's 56 member jurisdictions. Source: NAIC, August 2025 legislative brief, via Akin Gump.
The practical effect is a patchwork: an insurer licensed in Ohio or New York faces a statutory cybersecurity program requirement with a hard notification deadline, while the same insurer's operations in a non-adopting state face no equivalent state-specific rule beyond general breach-notification law. For a licensed carrier or agency operating in an adopting state, the compliance sequence looks like this:
Figure 4: The compliance cycle an insurer follows once licensed in an MDL-668 state. Source: NAIC Insurance Data Security Model Law #668 text, summarized via Akin Gump and RadarFirst.
What happened when the industry's own regulator got breached?
The NAIC, the body that writes the model cybersecurity rules described above, disclosed its own breach in June 2026. The ShinyHunters group began exploiting a zero-day vulnerability in Oracle's PeopleSoft software on May 27, 2026, compromising more than 100 organizations before Oracle shipped an emergency patch on June 10. NAIC detected the intrusion on June 11 and disclosed it publicly on June 17, after ShinyHunters threatened to leak 3.1 terabytes of stolen data tied to the organization's internal financial-reporting systems.
Figure 5: Milestone insurance-sector breaches and regulatory events, 2024 to 2026. Sources: HHS OCR, state AG filings, TechRadar, BleepingComputer, Insurance Journal.
NAIC has said that no personal or banking information was accessed, and that the stolen files were limited to publicly available statutory financial reports, insurer investment credit-rating data, and technical logs. The incident is still notable precedent: the organization responsible for tracking which states require insurers to secure consumer data was itself compromised through a widely exploited enterprise software flaw, the same class of vulnerability MDL-668's risk-assessment requirement is designed to catch before it becomes a breach.
Major insurance-sector data breaches, 2024 to 2026
| Company | Records exposed | Date disclosed | Data type |
|---|---|---|---|
| Aflac | 13,924,906 | August 2025 (breach June 2025) | Health information, SSNs, government IDs |
| AssuranceAmerica | 6.9 million | March 2026 | Policy numbers, driver's license numbers, SSNs |
| Blue Shield of California | 4.7 million | April 2025 (exposure 2021-2024) | Health plan details, claim data, location data |
| Farmers Insurance | 1,071,172 | August 2025 (breach May 2025) | Names, addresses, driver's license numbers |
| Globe Life / American Income Life | 850,000 | January 2025 (breach October 2024) | SSNs, health data, policy information |
| Landmark Admin | 806,519 | October 2024 (breach May-June 2024) | SSNs, bank details, life and annuity data |
The Bottom Line
Insurance carriers hold the kind of data that makes a single breach expensive to consumers: health records, government IDs, and financial account numbers in one file, the same combination that makes small businesses handling any of that data a target regardless of industry. The 2024-2026 breach record shows attackers reaching that data less through sophisticated exploits and more through social engineering aimed at employees and third-party vendors, the exact gap MDL-668's annual risk assessment and incident-response-plan requirements were written to close. With only half the NAIC's member jurisdictions having adopted that model law, and with the NAIC itself compromised through an unpatched enterprise application, the practical baseline for any insurance-adjacent business, whether or not your state has adopted MDL-668, is the same: know what personal data you collect, say so in a current privacy policy, and have a documented plan for the 72-hour notification clock many states already require.
Frequently Asked Questions
How many people were affected by the Aflac data breach? The breach exposed the protected health information of 13,924,906 people according to the company's own filing with the US Department of Health and Human Services' Office for Civil Rights. The intrusion occurred on June 12, 2025, and was linked to social engineering tactics associated with the Scattered Spider group.
How many states regulate insurer cybersecurity programs? 28 of the National Association of Insurance Commissioners' 56 member jurisdictions had adopted the Insurance Data Security Model Law (MDL-668) as of the NAIC's August 2025 legislative brief, per Akin Gump's review. The other 28 states, territories, and Washington DC have no equivalent state-level requirement.
Was the insurance industry's own regulator breached? Yes. The NAIC disclosed in June 2026 that the ShinyHunters group stole 3.1 terabytes of data by exploiting a zero-day vulnerability in Oracle's PeopleSoft software. The NAIC said the stolen data included statutory financial reports and technical logs, and stated no policyholder or personal data was accessed.
What is the most common cause of insurance-sector data breaches? Business email compromise and funds transfer fraud together accounted for 58% of the cyber incidents Coalition's insured businesses reported in 2025, more than ransomware, according to Coalition's 2026 Cyber Claims Report. Several of the largest 2025-2026 carrier breaches, including Aflac and AssuranceAmerica, were also linked to social-engineering attacks rather than technical exploits.
Where the Numbers Come From
- HIPAA Journal. (2025). "Aflac Data Breach: PHI of At Least 13.9 Million Individuals Compromised." 13,924,906 individuals, per HHS Office for Civil Rights filing, breach dated June 12, 2025.
- Cybersecurity Dive. (2026). "Data breach hits car insurance provider." AssuranceAmerica, more than 6.9 million people, detected March 17, 2026.
- Healthcare Dive. "Blue Shield of California exposed data of 4.7M people to Google." Exposure period April 2021 to January 2024, filed with regulators April 2025.
- Carrier Management. (2025). "Farmers Insurance Data Breach Could Impact More Than a Million Customers." 1,071,172 individuals confirmed, breach dated May 29, 2025.
- Bloomberg Law. "Globe Life to Pay $4.66 Million to Settle Suit Over Data Breach." American Income Life Insurance Company, approximately 850,000 people notified, breach dated October 2024.
- Insurance Journal. (2024). "Landmark Admin Reports Data Breach, Exposing 800,000 Users' Information." 806,519 people per Maine Attorney General filing, breach dated May-June 2024.
- Verizon. (2025). "2025 Data Breach Investigations Report." Financial and Insurance sector: 3,336 incidents, 927 confirmed breaches.
- Akin Gump. "Additional States Adopt Cybersecurity Requirements for Insurance." 28 of the NAIC's 56 member jurisdictions have adopted MDL-668, per NAIC's August 2025 legislative brief.
- TechRadar. (2026). "NAIC confirms data breach with ShinyHunters claiming 3.1TB of data stolen in Oracle zero-day attack." Disclosed June 17, 2026.
- Coalition. (2026). "2026 Cyber Claims Report." Business email compromise and funds transfer fraud accounted for 58% of 2025 incidents; 52% of funds-transfer-fraud claims originated from BEC.
Note: All figures verified as of September 2026. The AssuranceAmerica, Farmers Insurance, Aflac, and Landmark Admin totals are drawn from company or regulator filings current as of publication and may be revised upward as investigations continue. This post will be refreshed at least twice a year to track new breach disclosures and NAIC model law adoption.
