The Bigger They Are, the Harder They Get Breached
Erie Insurance and Aflac just got dragged through the digital mud. Two big-name companies with massive budgets, tons of customers, and—allegedly—tight security. And yet? Boom. Breached.
Now, before you roll your eyes and say, “Yeah, but I’m just a small business,” let me stop you right there, champ.
Because if they can’t protect their customers with all their firepower, what makes you think you’re in the clear with a router from 2017 and a part-time IT guy named Kevin?
This isn’t fear-mongering. It’s a heads-up. And it’s exactly why I’m going to walk you through what happened, why it matters to your business, and five things you better lock down right now if you want to avoid your own headline.
Let’s roll.
The “Secure” Giants Who Got Slapped
These weren’t backroom startups or some guy running QuickBooks out of his garage. Erie Insurance and Aflac are billion-dollar giants. And yet, both got absolutely disrupted
by cyberattacks in 2025. Let’s call it what it is: embarrassing.
Here’s what went down:
- Erie Insurance disclosed unauthorized access to their network through a third-party vendor. As of their latest statement, no evidence of stolen data has been confirmed.
- Aflac confirmed suspicious activity in their systems and potential exposure of sensitive customer data, including policyholder information
- And don’t think this is just their problem. If you’re storing client data — even basic stuff like emails or invoices — you’re on the hook if it leaks. In fact, breaches like this prove a hard truth:
Even the “big dogs” can’t always protect their digital bones.
So if you think your small business is safe because you’re flying under the radar? Hate to break it to you, sugar, but the radar is automated now, and it doesn’t care how small you are.
Hackers are smart, fast, and constantly scanning for weak links.
And guess who looks like an easy target?
- Businesses with no multi-factor authentication
- Companies with one IT guy doing it all
- Teams that use the same password for everything (“Password123” isn’t clever, folks)
Erie and Aflac had the resources and still got hit hard. You don’t have a million-dollar IT budget, so what makes you think you’re safe?
Bottom line: size doesn’t equal security. You can either get proactive or get caught. There’s no third option.
Why SMBs Are Even Easier Targets
You’re not a Fortune 500 company. You’re a hardworking, boots-on-the-ground kind of business. That’s exactly why attackers love you.
Here’s why small businesses are the sweet spot for hackers:
- You usually have fewer security tools in place.
- You think you’re “too small” to be a target.
- You don’t have a dedicated cybersecurity team.
- Your team wears twelve hats and clicks before thinking.
That’s not an insult. That’s the reality of running lean. But lean can’t mean loose when it comes to protecting client and employee data.
“Most cyberattacks don’t start with some Hollywood hacker in a hoodie.” “They start with one of your team members clicking a bogus email.”
Examples of Real Risks:
- Phishing emails disguised as invoices or Dropbox links
- Fake login pages that steal your credentials
- Weak passwords used across multiple tools
One wrong click can compromise:
- Your customer database
- Your financial records
- Your entire network
Hackers don’t need to be brilliant. They just need you to be distracted.
So no, it’s not about scaring you. It’s about slapping reality on the table:
- You are a target.
- You are vulnerable.
- And you have more to lose than you think.
Want to stop being easy pickings?
You’ve got to bake cybersecurity into your operations the same way you track payroll or customer service. It’s not a bonus. It’s survival.
Cyber Insurance Isn’t a Magic Shield
You know what I hear all the time? “It’s okay, Digit, we’ve got cyber insurance.”
Good. Now read the fine print.
Cyber insurance helps cover the cost of a breach, but it doesn’t stop the breach from happening. It’s like saying flood insurance will keep your office from getting wet. It won’t. It just helps mop up the mess after the damage is done.
Here’s what cyber insurance WON’T do:
- Prevent ransomware from locking up your files
- Stop hackers from phishing your bookkeeper
- Rebuild your clients’ trust after their data leaks
- Pay out if you didn’t follow basic security protocols
If you don’t have MFA, endpoint protection, or working backups? You might not see a dime from your policy.
And trust me, your customers won’t care that your insurance helped pay your bills. They care that their Social Security numbers and banking info are floating around the dark web because you didn’t lock things down.
What you really need is:
- Prevention
- Detection
- Response
- Recovery
Cyber insurance is the recovery. But without the first three? You’re toast.
So yeah, get the policy. But don’t confuse it with protection. You need both.
Because guess what? The average breach for an SMB costs $120,000 and 2 weeks of downtime.
Hope you’ve got more than a deductible in your rainy day fund.
5 Things to Lock Down Now
Let’s get tactical. You don’t need a cybersecurity Ph.D. You need a checklist, some help from your MSP (hi, that’s us), and a plan that doesn’t depend on luck.
- Enable MFA on everything
If your email, accounting software, or client portals don’t have multi-factor authentication turned on, you’re leaving the keys in the ignition.
No excuses. Turn it on.
- Back up your data (and test the restore)
Backing up doesn’t mean squat if you can’t actually restore your data. Run test restores monthly. Know what’s getting backed up and where it lives.
- Use email filtering and endpoint protection
Don’t rely on good judgment alone. Use smart filters to block spam, malware, and phishing links before your employees ever see them. Pair that with strong endpoint protection to keep devices clean.
- Train your team regularly
Cybersecurity training isn’t a once-a-year box to check. Run monthly microtrainings. Use phishing tests. Keep your people sharp.
- Create a response plan
If something happens, who calls who? What gets shut down? Where’s the checklist?
If your plan is “panic,” it’s time to fix that.
Final Digit Tip: Get your MSP to run a full audit. We’ll tell you what’s locked down, what’s wide open, and how to fix it.
This isn’t paranoia. It’s preparedness. Because one day, it won’t be a drill.
You Don’t Have Their Budget — So You Need Better Discipline
Erie and Aflac had money, staff, and legal teams… and they still blew it.
You? You’ve got bills, passwords on sticky notes, and maybe a backup drive you haven’t tested since 2021. That means you don’t have the luxury of ignoring this stuff.
Cybersecurity isn’t a someday thing. It’s a right now thing. Because when—not if—you get targeted, you want to be the business that’s ready. Not the one writing apology emails to your entire customer base.
So here’s what I want you to do:
- Schedule a security consultation with us — we’ll find the cracks before someone else does
- Follow 2 Dog Digital for weekly tips, updates, and bark-worthy truths about keeping your business safe
No scare tactics. No sales pitch. Just straight talk, solid protection, and a team that won’t leave you hanging when it counts.
Let’s get you locked down, cleaned up, and ready to roll.
Digit out. 🐾
Disclaimer: All incident details referenced are based on publicly available information and official company statements as of July 2025. This post is intended for educational and informational purposes only