Aflac Hit in Insurance Industry Hacking Spree

June 21, 2025

•

20 min read

Share this post

Don’t Let the Spider Bite 🕷️

Aflac Hit in Insurance Industry Hacking Spree — Is Your Business Next

Another day, another breach — and this time, it’s big. Insurance giant Aflac has confirmed a cyber intrusion potentially exposing sensitive client data, including Social Security numbers, insurance claims, and health information.

This isn’t an isolated incident. In the last few weeks, Erie Insurance and Philadelphia Insurance Companies have also fallen victim to a coordinated wave of cyberattacks. The culprit? A young but aggressive threat actor group known as Scattered Spider, notorious for social engineering and lightning-fast infiltration.

What Happened?

Aflac, one of the largest providers of supplemental health insurance in the U.S., disclosed that attackers breached their systems using social engineering tactics — impersonating tech support staff to trick employees into giving up access.

Despite Aflac detecting and stopping the intrusion within hours (and reporting that no ransomware was deployed), the scale of potential exposure is massive. The FBI and cybersecurity experts are now urging all companies in the insurance and healthcare space to harden their defenses immediately.

Why This Matters for SMBs, Healthcare, Law Firms, and Schools

You don’t need to be a Fortune 500 company to become a target. Scattered Spider doesn’t discriminate — they’ve gone after casinos, retailers, schools, and now the insurance sector.

If your employees use weak passwords, skip MFA, or get tricked by a fake IT call, your entire business could be paralyzed in under 24 hours.

Imagine a school system locked out of student data. A law firm’s case files leaked. A small healthcare clinic’s patient records exposed. It’s not just embarrassing — it’s catastrophic.

What You Can Do Today

Train your staff to spot social engineering — no, that “tech support” caller isn’t who they claim.
Implement real-time threat monitoring and endpoint detection (EDR).
Enable MFA across all cloud and SaaS platforms.
Review your disaster recovery and incident response plan.
And please — ditch the “default” admin password.

Final Thought

This isn’t just about Aflac. It’s about every business that handles sensitive information. The next breach headline could have your name in it — unless you’re prepared.

====================================

Follow me for mind-blowing information and cybersecurity news. Stay safe and secure!

70% of all cyber attacks target small businesses. I can help protect yours.

Share this post

See some more of our most recent posts...

Technology

Cybersecurity

Tips

Must-Read

Your Phone Number Is a Skeleton Key Stop Handing It Out

July 14, 2025

•

20 min read

Your Phone Number Is a Skeleton Key—Stop Handing It Out

Your phone number is more than a contact detail. It’s a gateway to your entire digital identity—and for hackers, it’s the easiest way in.

The Hidden Risk Behind SMS-Based Two-Factor Authentication (2FA)

Two-factor authentication (2FA) is one of the most widely recommended defenses against account takeovers. But when your second factor is an SMS text message, you’re not nearly as secure as you think. That’s because mobile phone numbers can be hijacked—and once that happens, attackers can intercept those 2FA codes, impersonate you, and access your most sensitive information.

This is exactly what happens in a SIM swap attack—a growing threat with serious real-world consequences.

What Is a SIM Swap Attack?

A SIM swap attack occurs when a scammer convinces your mobile carrier to transfer your number to a new SIM card they control. They may use stolen personal information—like your name, birthday, address, or even leaked Social Security number—to impersonate you in a call or chat with customer service.

Once your number is ported over, your real phone loses service—and the attacker receives all your incoming texts and calls. This includes:

Login codes from your bank
Password reset links from your email provider
Security alerts from work systems
Voicemail access and call-forwarding controls

With this power, the attacker can quickly take over your email, financial accounts, and even enterprise systems tied to your identity.

Real Victims. Real Losses.

In 2023 alone, the FBI reported over $50 million in losses from SIM swap attacks. In one high-profile case, a crypto investor had his wallet drained while flying cross-country. He lost service mid-flight and landed to find his exchange accounts emptied. He’d been SIM-swapped while offline.

In another case, attackers used SIM swap access to impersonate a tech executive—convincing business partners to send funds to fraudulent addresses, totaling over $450,000 in stolen assets.

This isn’t a fringe problem—it’s organized, scalable cybercrime. And anyone with a phone number is a potential target.

Why SMS Is So Easy to Exploit

No encryption: SMS is not end-to-end encrypted. Your messages travel across networks in plaintext.
Carrier vulnerabilities: Mobile providers vary widely in how well they verify identity. Some still fall for basic impersonation or social engineering.
SS7 flaws: The global signaling system (SS7) that routes SMS and calls has known vulnerabilities that can be exploited to intercept messages.
Recycled numbers: Carriers routinely recycle old numbers. If you don’t update your accounts after changing numbers, the new owner could receive your 2FA codes.
Phone malware: If your device is compromised, hackers can steal SMS codes directly—even without a SIM swap.

Safer Alternatives to SMS-Based 2FA

1. Authenticator Apps

Apps like Google Authenticator or Microsoft Authenticator generate time-based, offline codes on your device. They’re not tied to your phone number and can’t be intercepted via SIM swap.

2. Hardware Security Keys

Physical devices like Yubikey or Titan Security Key plug into your computer or pair with your phone. They require physical presence to log in—offering near-unbreakable protection against phishing and interception.

3. Separate 2FA Devices

High-risk users (executives, admins, compliance officers) should consider having a dedicated 2FA device—a second phone number or authenticator not used for calls, email, or browsing.

4. Proxy Emails and Phone Numbers

Use unique email aliases or masked phone numbers for account signups. Services like SimpleLogin or AnonAddy allow you to create and manage these securely, keeping your real identity protected.

Carrier Security Settings You Should Activate Right Now

AT&T:

Wireless Account Protection Lock
Enables additional verification before port-outs or SIM changes
Manage in the AT&T app or online portal

T-Mobile:

Port Validation & Account Lock
Prevents unauthorized number transfers
Configurable in your account settings

Verizon:

Number Lock & SIM Protection
Blocks SIM swaps and delays suspicious account changes by 15 minutes
Enabled via the MyVerizon app

Don’t Trust Your Device Blindly

Even with good 2FA, a compromised phone can undo all your efforts. Infostealing malware can:

Read your messages
Harvest session tokens
Record keystrokes and clipboard data
Upload login credentials and cookies to criminal servers

Run regular antivirus scans. Avoid sideloading apps. Monitor activity via mobile threat detection tools like Lookout or Zimperium if you’re in a regulated industry.

The Bigger Picture: A Culture of Caution

Protecting your identity isn’t about fear—it’s about friction. Good cybersecurity introduces just enough friction to slow down attackers while keeping your workflows usable.

For businesses, that means:

Enforcing app-based or hardware MFA for sensitive logins
Educating employees about SIM swaps and social engineering
Monitoring for leaked credentials using services like HaveIBeenPwned or SpyCloud
Using advanced endpoint and mobile device management (MDM) tools

70% of all cyber attacks target small businesses. I can help protect yours.

#SIMSwap #CyberSecurity #2FA #IdentityProtection #ManagedIT #DataBreach #SMBSecurity #InfoSec

Technology

Cybersecurity

Tips

It’s not a trend. It’s the end of passwords

July 13, 2025

•

20 min read

Say Goodbye to Passwords

Passkeys are rewriting the rules of authentication — and they don’t care about your memory.

For decades, passwords were the gatekeepers of the internet — and our downfall. Weak, reused, and phished credentials have enabled breach after breach, turning humans into the weakest link in cybersecurity. But in 2025, a different kind of key is rising: the passkey.

Driven by the FIDO Alliance and backed by Apple, Google, and Microsoft, passkeys use public key cryptography to eliminate the need for shared secrets altogether.

Let’s break it down.

What Are Passkeys?

Passkeys are digital credentials that replace passwords entirely. Unlike passwords, they’re not stored on websites. They’re created and stored securely on your device or credential manager, and never transmitted — not even during login.

Instead of “knowing a password,” users simply authenticate using biometrics (fingerprint, face ID) or a device PIN. Behind the scenes, the process relies on cryptographic key pairs.

How It Works (Simplified)

You register with a website: Your authenticator (e.g., Bitwarden, iCloud Keychain) creates a public/private key pair.
The private key stays with you: It’s stored securely and never shared.
The public key is sent to the site: The website saves this key with your account.
Next time you log in: The site sends a challenge, and your authenticator signs it with your private key. The site verifies it with your public key.

No password. No shared secret. No phishing risk.

Why SMBs and Professionals Should Care

If your business still relies on passwords, you’re a target. From healthcare and law firms to small businesses and schools, weak credentials remain the #1 vulnerability.

Passkeys reduce risk by:

Preventing phishing and smishing
Eliminating password reuse
Simplifying secure login for employees
Offering future-proof compliance and user experience

Pro Tips for Adopting Passkeys

✅ Choose a cross-platform credential manager like 1Password or Bitwarden

✅ Start enabling passkeys for supported services

✅ Don’t delete passwords — yet. Keep them as backup until adoption is widespread

✅ Download and store recovery codes securely

✅ Use hardware security keys (e.g., Yubico) for high-value credentials

The Road Ahead

Most major platforms already support passkeys, and more are joining weekly. But adoption isn’t always smooth. Expect quirks, mismatches, and transition friction. Still — like HTTPS, MFA, and endpoint protection — passkeys are a necessary step forward.

It’s not a trend. It’s the end of passwords.

70% of all cyber attacks target small businesses. I can help protect yours.

Technology

Cybersecurity

Must-Read

Tips

Protect your cell number from SIM swap attacks, here’s how

July 10, 2025

•

20 min read

Protect your cell number from SIM swap attacks, here’s how.

Locked Out? Protect Your Phone Before It’s Too Late.

SIM Swap Attacks: The Silent Heist Targeting Your Cell Number

In today’s hyper-connected world, your cell phone number isn’t just for calls and texts—it’s your digital identity. But with SIM swap attacks on the rise, hackers are exploiting phone carriers’ weaknesses to hijack numbers, bypass security, and drain accounts.

How Does a SIM Swap Attack Work?

Here’s how scammers pull it off:

They gather your personal information—like your name, birthdate, and address—from data breaches, social media, or shady online sources.
Pretending to be you, they contact your phone carrier and request your number to be “ported” to a new SIM card.
Once approved, your phone goes dark—and the hacker now controls your number.
They intercept your calls and texts, including two-factor authentication (2FA) codes, giving them access to your bank, crypto, email, and more.

Key Sign: Sudden loss of cell service for no reason? That’s your red flag.

How Can You Protect Yourself?

Most U.S. carriers now offer free protections—but you need to activate them manually:

✅ AT&T:

Wireless Account Lock

Prevents SIM swaps or number transfers.
Activate via the AT&T app or your online account.
Secure your AT&T account with a strong password & multi-factor authentication.

✅ T-Mobile:

SIM Protection & Number Porting Block

Blocks unauthorized SIM swaps or number ports.
Enable in your T-Mobile online account.

✅ Verizon:

SIM Protection + Number Lock

Prevents SIM swaps & phone number transfers.
Activate via the Verizon app or online account.
Adds a 15-minute delay for added safety if turned off.

Extra Tips to Stay Safe:

Avoid SMS-based 2FA; use authenticator apps instead.
Don’t reuse passwords across accounts.
Watch for phishing emails pretending to be from your carrier.
Regularly check your carrier settings for security updates.
Use a separate phone number for sensitive accounts when possible.

Why It Matters to SMBs, Healthcare, Law Firms, & Schools:

Your staff’s phone numbers are also keys to your business network. One weak link—like a SIM swap—could expose sensitive company data, finances, or client information.

Encourage your employees to enable carrier protections, use app-based 2FA, and regularly audit their security settings.

Tagline: 70% of all cyber attacks target small businesses. I can help protect yours.

#Cybersecurity #DataProtection #SIMSwap #IdentityTheft #MobileSecurity