Farmers’ HIPAA Breach Affects 1.1 Million; Aflac Is Still Counting Victims
Two major U.S.-based insurers – Farmers Insurance and Aflac Inc. – have reported data breaches in two separate cyberattacks. The breaches follow a spree of data exfiltration incidents over the spring and summer that hit multiple large players in the insurance sector.
See Also: Post-Quantum Cryptography – A Fundamental Pillar in the Future of Cybersecurity [ES]
Farmers, which offers a variety of insurance products including coverage for vehicles, property, life and businesses, filed two breach reports to Maine’s attorney general’s office for different parts of the company on Friday, saying a May hacking incident involving a third-party vendor affected more than 1.1 million people.
Meanwhile, the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website on Monday showed that Aflac on Aug. 8 reported to HHS’ Office for Civil Rights that a cyber incident detected in June resulted in a HIPAA breach affected at least 500 people – a placeholder estimate.
Aflac is one of the largest providers of supplemental health insurance in the United States. The company first alerted the U.S. Securities and Exchange Commission on June 20 about the incident (see: Aflac: ‘Cybercrime Campaign’ is Targeting Insurance Industry).
In its breach reports submitted to Maine’s AG office, Farmers New World Life Insurance Co. said the May hacking incident on a vendor’s database containing Farmers’ customer information affected 40,214 people.
A separate breach report also submitted to Maine regulators on behalf of other operations of Farmers – “Farmers Insurance Exchange, Farmers Group, Inc. (its attorney-in fact), and their subsidiaries and affiliates” – said 1.07 million people were affected by the same May hack.
The cyber incidents at Aflac and Farmers both appear to have occurred within a May-June timeline of several attacks on insurance sector including Erie Insurance and Philadelphia Insurance Companies’ Tokio Marine America unit, both of which said in June that they detected incidents involving data exfiltration. Researchers at the time said each of the incidents appeared tied to attacks launched by cybercrime gang Scattered Spider (see: Two Insurers Say Ongoing Outages Not Ransomware-Based).
Aflac in a public disclosure in June about its incident, said it was a victim of a coordinated campaign targeting insurance companies caused by “a sophisticated cybercrime group.”
On Monday, Aflac declined to comment to Information Security Media Group about allegations of Scattered Spider’s involvement in the company’s hack.
“Although an analysis of potentially impacted individuals and data involved is ongoing and may take time to complete, we have submitted preliminary notifications to certain state and federal regulators in connection with the incident,” Aflac told ISMG in a statement. “We plan to update these filings once the review of potentially impacted files has been completed.”
Any individual who contacts Aflac’s dedicated call center will receive complimentary CyEx Medical Shield, which includes credit monitoring, identity theft protection, medical fraud protection, and customer support, for 24 months, Aflac said.
Aflac said that it identified suspicious activity on its network on June 12. “We promptly initiated our cyber incident response protocols and stopped the intrusion within hours.” The company’s businesses remained operational, and its systems were not affected by ransomware, Aflac said.
Farmers’ Breach
Farmers did not immediately respond to ISMG’s request for additional details pertaining to its incident, including whether Scattered Spider is the suspected threat actor in the incident involving Farmers’ third-party vendor. Farmers also declined ISMG’s request for the identity of its breached vendor.
But in a statement to ISMG, Farmers said its investigation – conducted with both internal and external security experts – “found no evidence that the exposed data has been misused, nor any indication that Farmers’ own systems were compromised.” Farmers said the company is offering affected individuals complimentary credit monitoring.
Farmers in a breach notification statement posted on its website said that on May 30, one of its third-party vendors alerted the insurer to suspicious activity involving “an unauthorized actor accessing one of the vendor’s databases containing Farmers customer information.”
Farmers said the unnamed third-party vendor had monitoring tools in place, “which allowed the vendor to quickly detect the activity and take appropriate containment measures, including blocking the unauthorized actor.”
Farmers said it immediately launched an investigation to determine the nature and scope of the incident and notified law enforcement authorities.
The investigation found that an unauthorized actor accessed the vendor’s database on May 29, and acquired some data, Farmers said. On July 24, the review of affected data determined that some personal information related to “a select population of Farmers customers” was subject to unauthorized access and acquisition, Farmers said.
Personal information contained in the compromised database includes individuals’ name, address, date of birth, driver’s license number, and/or last four digits of Social Security numbers. “There was no evidence demonstrating that additional personal information was accessed,” Farmers said.