Aflac sued over alleged failure to safeguard sensitive customer information

A lawsuit has been filed against the American supplemental insurance company Aflac, alleging that it failed to protect customers’ sensitive data from an unauthorised network breach.

 

Headquartered in Columbus, Georgia, Aflac known for providing supplemental insurance, especially in the areas of cancer and other critical illnesses.

 

In a data security incident notice filed with the the U.S. Securities and Exchange Commission (SEC), Aflac said that on June 12, the company identified unauthorised access to its internal network. Aflac immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

The insurance giant also activated its incident response protocols, contained the network intrusion within hours and notified relevant law enforcement authorities about the same.

 

“The Company’s business remains operational, and its systems were not affected by ransomware. The Company continues to serve its policyholders as it responds to this incident and can underwrite policies, review claims, and otherwise service customers as usual,” Aflac said.

 

Aflac added that although its investigation is still in the early stages, the compromised data includes claims details, health information, Social Security numbers, and other personal data pertaining to customers, beneficiaries, employees, agents, and other individuals within its U.S. operations. The company will notify affected individuals once the investigation is complete.

 

A lawsuit has been filed in federal court in the Middle District of Georgia, alleging that Aflac failed to adequately protect policyholders’ private information in a cyber security incident. The suit also claims the company delayed notifying affected customers and did not provide complete details about the breach.

 

The plaintiff, Martha Graham, an Aflac policyholder residing in Union Springs, Alabama, is seeking compensatory and punitive damages. She argues that the exposure of her personal information puts her at risk for crimes such as identity theft, including the unauthorised opening of accounts, taking out of loans, and fraudulent claims for government benefits and tax refunds.

 

Aflac has not yet filed a response to the complaint, and a company representative stated that Aflac could not comment on the pending lawsuit.