U.S. insurance giant Aflac has confirmed that a cyberattack on its American network exposed personal and health information belonging to roughly 22.65 million individuals globally, a figure the company settled on in a December 19, 2025 update after nearly six months of data review. Figures in circulation vary by source and by scope: TechShots reports 22.6 million, EveryTicker and the Kayne McGladrey analysis of Aflac's own update cite 22.65 million, the federal court handling the consolidated class action describes "approximately twenty-two million individuals," and the HHS Office for Civil Rights breach portal lists 13,924,906. That last number is not a contradiction so much as a jurisdictional boundary: it captures only the U.S. HIPAA-covered population, leaving roughly 8.7 million affected people outside U.S. regulatory reporting entirely. On August 12, 2026, Judge Clay D. Land of the Middle District of Georgia largely denied Aflac's motion to dismiss, pushing the case into discovery.
Separately and more recently, Aflac's Japanese subsidiary disclosed a second, unrelated intrusion in June 2026 affecting approximately 4.4 million customers. The two incidents are frequently conflated in coverage. They are not the same event, and this brief treats them separately.
What Happened
The U.S. incident began on June 12, 2025, when attackers used social engineering against Aflac personnel to obtain network access. Per the account in the Kayne McGladrey writeup of the litigation record, the intrusion was detected and contained within hours. There was no ransomware deployment, no file encryption, and no operational disruption. Aflac told ABC7 on June 20, 2025 that it could still "underwrite policies, review claims, and otherwise service our customers as usual," and characterized the event as part of a broader cybercrime campaign against the insurance industry.
The detection-to-containment speed is the one genuinely strong part of Aflac's posture here. The rest of the timeline is slower. Public disclosure came eight days after intrusion, on June 20, 2025. The data review that determined who was actually affected did not conclude until December 4, 2025. Notification letters began going out on December 23, 2025, more than six months after the attack.
One account diverges on root cause. TechShots reports that the incident "stemmed from a vulnerability at a third-party service provider." No other source in this set supports that characterization, and it conflicts with the social engineering account reflected in Aflac's own statements and the litigation record. Treat the third-party vendor claim as unconfirmed.
The Japan incident followed a different pattern. According to Japanese outlets summarizing Aflac Life Insurance Japan's own disclosures, attackers accessed the "Aflac Yorisou Net" policyholder portal and the "Online Consultation" system. Aflac Japan discovered the compromise on June 25, 2026, cut off access the same day, and suspended parts of the environment. Its first public report came June 30, 2026. A second report on July 13, 2026 revised the initial intrusion date backward from June 15 to June 10, 2026, and adjusted the affected-record counts. Aflac Japan stated the attacker traffic resembled normal user access closely enough that detection controls did not flag it. A Korean report from DailySecu, citing Aflac's SEC filing, notes the Japan intrusion was confined to Japanese systems with no evidence of access to U.S. infrastructure.
What Was Taken
For the U.S. breach, the exfiltrated files contained names, Social Security numbers, dates of birth, driver's license numbers, government-issued identification, and medical and health insurance information. Aflac's June 2025 statement specified that affected files related to customers, beneficiaries, employees, agents, and other individuals in its U.S. business, meaning the exposure is not limited to policyholders.
That combination is close to a worst case for identity fraud. SSN plus DOB plus government ID plus health data is a complete synthetic identity kit, and unlike a payment card it cannot be reissued. Aflac offered 24 months of free credit monitoring, identity theft protection, and Medical Shield to anyone who contacted its call center.
For the Japan incident, the disclosed fields are different: customer names, dates of birth, gender, addresses, phone numbers, policy numbers, coverage details, and premium transfer bank account information. Approximately 4.4 million customers were affected, of whom approximately 220,000 had bank account details exposed. Roughly 40,000 agencies also had representative names, addresses, and phone numbers disclosed. Aflac Japan states that My Number identifiers, credit card data, email addresses, and portal credentials were not involved, and that as of August 24, 2026 no confirmed misuse had been observed.
On August 24, 2026, Aflac Japan began handing the leaked account details (branch name, deposit type, account number, account holder name, or the symbol/number pair for Japan Post Bank) to the relevant financial institutions so those banks could flag the accounts and increase transaction monitoring. The company says it cleared this transfer in advance with the Personal Information Protection Commission under Article 27(1)(ii) of Japan's personal information law.
Why It Matters
Three things make this worth defenders' attention beyond the headline count.
First, the gap between the 22.65 million global figure and the 13.9 million on the HHS OCR portal is a case study in how regulatory breach counts systematically understate real exposure. Anyone benchmarking incident severity against OCR data is working from a truncated view. The roughly 8.7 million difference represents real people whose data was taken and who simply fall outside the reporting regime.
Second, the August 2026 ruling signals that fast containment does not insulate a company from liability. Aflac stopped the intrusion in hours, yet Judge Land let negligence, negligence per se, breach of implied contract, unjust enrichment, litigation expenses, and a Declaratory Judgment Act claim proceed to discovery on behalf of eighteen named plaintiffs representing a nationwide class and a California subclass. The court did dismiss the CCPA, CMIA, and Georgia Uniform Deceptive Trade Practices Act claims, and deferred the factual standing challenge. The surviving theory rests on inadequate security controls before the breach, not on response quality after it.
Third, two major intrusions at the same insurer within twelve months, on two continents, through two unrelated vectors, suggests the insurance sector is under sustained and adaptive pressure rather than opportunistic hits. EveryTicker's investor-facing summary lists both incidents alongside $139 million in troubled commercial real estate loans as operational risks warranting monitoring, while noting management's position that neither will materially affect financial condition.
The Attack Technique
For the June 2025 U.S. intrusion, the entry vector was social engineering against people, not exploitation of software. Attackers talked their way into the network. Aflac has not formally attributed the attack. DailySecu reports that security industry analysis found the tradecraft consistent with Scattered Spider, the English-speaking social engineering crew known for help desk impersonation, MFA fatigue, SIM swapping, and account takeover against large enterprises. The same reporting connects that cluster to intrusions at Erie Insurance and Philadelphia Insurance Companies during the same period, and notes that Scattered Spider typically partners with ransomware operations including Qilin, RansomHub, and DragonForce rather than developing its own encryptor. Treat the Scattered Spider link as a researcher assessment, not a confirmed attribution.
The Japan intrusion looks operationally different. Aflac Japan describes repeated unauthorized access to customer-facing web systems between June 10 and June 25, 2026, using access patterns indistinguishable from legitimate use. That is the signature of valid-credential abuse or authorization flaws being walked through at scale rather than an exploit chain, and it is why the activity ran for roughly fifteen days without triggering alerts. Aflac Japan's stated remediation focuses on strengthening authentication and authorization, adding bulk-access monitoring, expanding security reviews and penetration testing, and tightening management oversight. Digital forensics work with an external cybersecurity firm was ongoing at disclosure; Japan's Financial Services Agency and police were notified.
What Organizations Should Do
-
Harden the help desk, not just the perimeter. Social engineering against identity verification workflows is the dominant enterprise entry vector for this threat cluster. Require out-of-band verification for password resets and MFA re-enrollment, prohibit verification based on data that appears in breach dumps, and log and review every credential reset on privileged accounts.
-
Alert on volume, not just anomaly. Aflac Japan's explicit finding was that the access looked normal. Baseline how many customer records a legitimate session, API key, or portal account should touch per hour, and alert on excess regardless of whether the credential is valid or the source IP is expected.
-
Compress mean time to respond, and measure data review separately. Aflac contained the U.S. intrusion in hours but took until December 4 to know who was affected. Pre-index sensitive data stores and pre-build the tooling to map exfiltrated files to affected individuals, or you will repeat the six-month notification lag and inherit the litigation exposure that follows it.
-
Assume exfiltration without encryption is the mission. No ransomware fired in either incident. Detection strategies tuned to encryption behavior would have caught neither. Invest in egress monitoring, data loss prevention on bulk reads, and canary records in high-value datasets.
-
Map your breach exposure against every applicable regime, not just the one you report to. Aflac's HIPAA-covered population was 13.9 million out of 22.65 million affected. Know in advance which populations fall outside your primary regulator so that notification planning covers everyone, not just the mandatory subset.
-
Treat bank account data as an active fraud enabler even without credentials. Account number and holder name alone will not drain an account, but they are high-grade inputs for targeted social engineering and impersonation fraud. Aflac Japan's decision to push the exposed account list to banks for monitoring is a defensible template for coordinated downstream defense.
Sources: TECHSHOTS Aflac Data Breach Exposes Personal and Health Re... | Aflac Announces Notification of 22.65 Million Customers After June... | アフラック生命保険で情報漏えい。約440万人に影響、不正アクセスの発生時期と対応を公表｜デジタルデータフォレンジック（DDF） PCや... | Aflac Breach Lawsuit Moves Forward After Ruling | IN RE AFLAC INC DATA BREACH LITIGATION, 4:25-cv-00183 | Aflac finds suspicious activity on US network that may impact Socia... | アフラック生命、サイバー攻撃で漏洩した口座情報を金融機関へ提供 約22万人が情報漏洩 対象セキュリティニュースのセキュリティ対策Lab | 보험사 공격 증가…아플락 일본법인 해킹, 고객 계좌정보까지 유출 < 해외 < 이슈 < 기사본문 - 데일리시큐