Aflac’s Japanese subsidiary disclosed on June 30, 2026 that Aflac disclosed hackers had broken into its Aflac Japan systems and stolen personal data belonging to 4.38 million customers.38 million people, the second major cyberattack to hit the insurance giant’s corporate family in just over a year. Aflac Life Insurance Japan Ltd., a wholly owned unit of the Georgia-based Aflac Incorporated, said an unauthorized third party accessed its systems for ten days before anyone noticed, according to a Form 8-K the company filed with the Securities and Exchange Commission and reporting from Security Affairs.
The breach hit “Aflac Yoriso Net,” the company’s customer-facing policyholder portal, along with other connected systems. Names, addresses, phone numbers, dates of birth, gender, security details, insurance account information and, for some customers, bank account data all left the building. Aflac says the exact mix of stolen data varies by customer.
For a company that spent the back half of 2025 explaining a breach of its US operations, this is not the headline Aflac wanted. It also raises an uncomfortable question for the wider industry, and it lands amid a fast-growing list of 2026 cybersecurity threats facing global businesses: if a company with Aflac’s resources and a full year of hindsight can get hit twice, what does that say about everyone else’s defenses?
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Aflac Japan Confirms Data Breach Affecting 4.38 Million Customers
Aflac Japan’s own language leaves little room for spin. In its Japanese-language customer notice, translated and reported by Security Affairs, the company said: “It has come to our attention that our customer-only website, ‘Aflac Yoriso Net,’ and other systems were subjected to unauthorized access by a third party, resulting in the leakage of some information, including customers’ personal information. At this time, no misuse of the information related to this incident has been confirmed.”
That last line matters, and it echoes the stance Aflac took after its 2025 US breach, when the company likewise said it was unaware of any fraudulent use of the stolen personal data. Aflac is drawing a distinction between data being copied and data being actively abused, a distinction that will likely shape both the regulatory response and any eventual class-action filings. The company says its investigation is ongoing with help from external cybersecurity experts, and that affected individuals will receive letters once Aflac finishes mapping exactly which fields were exposed in each case.
Timeline: How the Aflac Yoriso Net Breach Unfolded
Based on Aflac’s own disclosure, the intrusion ran from June 15 to June 25, 2026, following an intrusion window that ran from June 15 to June 25, 2026, during which the attacker sat inside Aflac Japan’s systems undetected. The company says it discovered the unauthorized access on June 25 and moved quickly to contain it by suspending the affected systems, a step that knocked some customer services offline during recovery.
Aflac Japan then spent five days on an initial investigation before going public on June 30, 2026, filing its 8-K with US regulators the same day it published its Japanese customer notice. Five days from discovery to public disclosure is fast by industry standards, especially compared with breaches elsewhere in the sector that have taken weeks or months to surface once investigators start digging.
| Date (2026) | Event |
|---|---|
| June 10-15 | Earliest reported point of unauthorized access to Aflac Japan systems |
| June 15-25 | Confirmed intrusion window per Aflac’s SEC filing |
| June 25 | Aflac Japan discovers the breach and suspends affected systems |
| June 25-30 | Internal investigation with third-party cybersecurity experts |
| June 30 | Public disclosure, Japanese customer notice, and Form 8-K filed with SEC |
| June 30 onward | Japan Financial Services Agency notified, individual customer letters pending |
What Customer Data Was Exposed
Aflac has been explicit that exposure is uneven across the 4.38 million affected people, and by Aflac Japan’s own count, about 230,000 of those customers had premium-payment account data exposed on top of their personal information, according to the Japan Times. Aflac Japan’s June 30, 2026 statement also disclosed that roughly 40,000 partner insurance agencies had data exposed alongside the customer records, per reporting from MLex. The confirmed categories include:
- Full names, mailing addresses and phone numbers
- Dates of birth and gender
- Security and authentication details tied to online accounts
- Insurance policy and coverage information
- Bank account information tied to premium payments, for a subset of customers
That combination of financial and policy-level data is what makes this data breach more dangerous than a typical email-and-password leak. Bank details tied to insurance premiums give fraudsters a direct line to attempt unauthorized withdrawals or to build convincing follow-up phishing messages, while policy specifics hand social engineers exactly the kind of insider detail that made help-desk impersonation so effective against other insurers in 2025.
Inside Aflac’s SEC Filing and Regulatory Notifications
Because Aflac Incorporated is a US-listed company, the Japan breach still triggered American disclosure obligations even though not a single US customer record was touched. The Form 8-K states: “On June 30, 2026, Aflac Life Insurance Japan Ltd. (‘Aflac Japan’), a wholly owned subsidiary of Aflac Incorporated, a Georgia corporation (the ‘Company’), issued a press release announcing that, on June 25, 2026, Aflac Japan discovered an unauthorized third-party had unlawfully accessed certain of Aflac Japan’s systems between June 15, 2026 and June 25, 2026.”
The filing also draws a firm boundary around scope: “Although the investigation remains ongoing, Aflac Japan has determined that certain impacted files contain policy and coverage details, personal information, and bank account information.” Aflac has stressed that the incident is confined to Japanese systems and that its US infrastructure was not accessed.
What the Japan FSA Notification Means
Aflac Japan also notified Japan’s Financial Services Agency and unspecified “other relevant authorities,” the standard first move for a regulated insurer operating in the country. Unlike the EU’s 72-hour GDPR breach-notification clock, Japan’s framework does not force insurers onto a fixed public-disclosure timeline, which helps explain why Aflac had five days between discovery and its public statement. The FSA can demand remediation plans and, in more serious cases, issue business improvement orders, but no fine or formal enforcement action tied to this incident has been made public as of this writing.
Is Scattered Spider Behind the Aflac Japan Breach?
Aflac has not named an attacker for the Japan breach, and neither the company’s press release nor its SEC filing point to a specific group. That is worth stating plainly, because it would be easy to assume this is simply a sequel to 2025’s wave of insurance-sector attacks.
What is on the record: Security Affairs, reporting on the Japan breach, noted that “Aflac is among several insurance companies hit in 2025 by cyberattacks, including Allianz Life, in a wave linked to the cybercrime group Scattered Spider.” That is a pattern observation about Aflac’s broader 2025-2026 exposure, not a confirmed technical attribution for the June 2026 Japan intrusion specifically.
Sources familiar with the investigation indicated to CNN that these incidents bear the hallmarks of a notorious and emerging cybercrime collective known as Scattered Spider.
CNN, reporting on Aflac’s 2025 cyberattack disclosure (source)
Until Aflac’s investigation concludes or a security research firm publishes forensic evidence, the responsible framing is to treat the 2026 Japan breach as unattributed, while acknowledging the obvious circumstantial overlap: a well-resourced insurer with a large personal-data footprint, hit for the second time in about a year, in an industry that a known threat actor has been actively working.
A Repeat Target: Aflac’s 2025 US Breach
This is not Aflac’s first incident. In June 2025, the company’s US operations were hit by a separate cyberattack that Aflac disclosed publicly within days of detection, after first describing the intrusion as limited to certain US systems; Aflac later specified that the unauthorized actor accessed personal information on June 12, 2025, and Reuters reported at the time that Aflac had halted the breach within hours of discovery, keeping its systems operational and avoiding a ransomware deployment while it opened a formal cyberattack investigation.
What Aflac Said About the 2025 Incident
Aflac told reporters it detected the intrusion within hours of the unauthorized access, and the company has said the actor accessed personal information on June 12, 2025. According to Aflac, social engineering — not a software flaw — enabled the attackers to gain unauthorized access to its US network, and Insurance Journal later reported that the incident was contained within hours, with Aflac’s systems remaining operational and no ransomware deployed against Aflac’s systems.
This attack, similar to those currently affecting many insurance providers, was orchestrated by a sophisticated cybercrime faction.
Aflac spokesperson, June 2025 (source)
According to Aflac, the attackers employed “social engineering” techniques to gain unauthorized access to its network.
Aflac, June 2025 disclosure (source)
Aflac itself stopped short of naming Scattered Spider in its public statements. Aflac’s own December 2025 update, filed with regulators, put the number at approximately 22.65 million individuals, after Aflac determined that the impacted files triggered legal notification requirements and said it had not identified any fraudulent use of the stolen information; Aflac began notifying those affected individuals once it completed its review of the files. TechCrunch reported on December 23, 2025 that the insurer had begun notifying that group, and SecurityWeek reported similarly on December 29, 2025, while The Record separately put the nationwide toll at roughly 22.7 million, including more than 2 million Texas residents. By February 2026, HIPAA Journal reported the confirmed tally had climbed further still, first to 13,924,906 people based on an updated filing with the Department of Health and Human Services’ Office for Civil Rights, and ultimately to about 26.5 million individuals once Aflac’s full disclosures to OCR were accounted for, roughly six times the scale of the 2026 Japan breach. TechCrunch reported the exposed data included dates of birth, addresses, Social Security numbers, ID numbers and health information, rather than the bank-account data now confirmed in the Japan case.
Scattered Spider’s Playbook: Why Insurers Keep Falling For It
Scattered Spider, also tracked by researchers as UNC3944 and Octo Tempest, does not rely on exotic malware or unpatched software. Per CISA’s public guidance on the group’s tactics, members pose as company IT or help-desk staff over the phone or by text message, ask employees or contractors to reset passwords or re-enroll multi-factor authentication, and bombard targets with repeated MFA push notifications until someone taps “approve” just to make the prompts stop, a technique known as MFA fatigue.
Insurers make unusually good targets for that approach. They run large, often decentralized IT environments spanning agents, brokers and legacy policy-administration systems, and their call centers are built around resolving requests quickly, not interrogating every caller. The 2025 wave reported to have touched Aflac, Allianz Life and other insurers exploited exactly that culture of speed.
Researchers who track the group describe a pattern that looks roughly like this in practice:
Caller: "Hi, this is [name] from IT. I'm locked out and I have a client
on hold. Can you reset my MFA so I can get back in?"
Help desk: verifies a name and employee ID, resets MFA enrollment
Attacker: enrolls their own device, signs in with phished or
purchased credentials
Result: full account access, no malware, no exploit, no alertThat simplicity is the point. Vishing calls do not trip antivirus software, and a help-desk agent trying to clear a call queue is a softer target than a patched firewall.
Market Impact: Aflac’s Stock, Revenue and Investor Confidence
Aflac remains a financially massive operation. The company posted $17.164 billion in revenue for fiscal year 2025, and traded with a market capitalization in the neighborhood of $58.7 billion as of mid-2026. The insurer serves more than 50 million policyholders combined across Japan and the United States, according to company materials, making it one of the largest suppliers of supplemental insurance in the world and, not coincidentally, one of the largest single repositories of sensitive personal and financial data in the industry.
Nothing in the public record so far shows a confirmed AFL share-price move tied directly to the June 30 disclosure, and Aflac has not said the breach will materially affect its financial results. But the reputational math is straightforward: this is Aflac’s second disclosed major breach in roughly thirteen months, and each incident adds to a due-diligence file that cyber insurers, institutional investors and regulators will not ignore forever.
IBM’s 2025 Cost of a Data Breach Report found the global average cost of a breach fell to $4.38 million, down 9% from $4.88 million in 2024, the first decline in five years. IBM credited faster identification and containment powered by AI-assisted defenses for the drop. Whether Aflac’s own costs land above or below that average will depend on litigation, notification expenses, and how many of the 4.38 million affected customers take up whatever remediation offer the company makes.
How the Aflac Breach Compares to Other 2026 Data Breaches
Aflac Japan’s 4.38 million figure is large but not close to the biggest breach disclosed this year. It sits in a crowded field of telecom and insurance incidents, several of them also originating in Asia-based subsidiaries of global companies.
| Company | Disclosed | People / Records Affected | Data Exposed |
|---|---|---|---|
| Aflac Japan | June 30, 2026 | 4.38 million | Names, addresses, DOB, policy details, bank account info |
| KDDI (Japan) | July 7, 2026 | 12.2M email addresses, 7.6M passwords | Email addresses and passwords via third-party zero-day |
| Aflac (US operations) | June 2025 | ~26.5 million (final tally per HIPAA Journal, Feb 2026) | Personal and health-related information |
| AT&T (dataset leak) | March 30, 2024 | ~73 million | Names, SSNs, DOB, account numbers |
| AT&T (cloud-linked incident) | July 12, 2024 | ~109 million accounts | Call and text metadata |
For a closer look at the KDDI incident referenced above, see Tech Insider’s coverage of the KDDI data breach. AT&T’s two 2024 incidents eventually produced a $177 million class-action settlement, split roughly $149 million for the March dataset case and $28 million for the July cloud-linked case, covering about 99.7 million notice recipients combined. That is the scale of financial exposure a large breach can generate once litigation runs its course, and it is the benchmark Aflac’s legal team is almost certainly watching.
Scattered Spider’s Known Insurance-Sector Targets
The Aflac Japan breach lands inside a broader pattern of attacks on insurers that started well before this year. Public reporting has connected the group to a string of 2025 incidents across the sector, though attribution confidence varies from case to case.
| Organization | Year | Status |
|---|---|---|
| Aflac (US operations) | 2025 | Confirmed breach, social engineering, Scattered Spider link reported by CNN but not confirmed by Aflac |
| Allianz Life | 2025 | Confirmed breach, publicly linked to the Scattered Spider wave |
| Erie Indemnity | 2025 | Reported target in the same wave of attacks |
| Philadelphia Insurance / Tokio Marine | 2025 | Reported target in the same wave of attacks |
| Aflac Japan | 2026 | Confirmed breach, attacker not publicly named |
Five confirmed or reported insurance-sector targets in roughly two years is enough to call this a sustained campaign against the industry rather than a string of coincidences, even where individual attribution remains unconfirmed.
The Regulatory Patchwork: Japan FSA vs US Disclosure Rules
The Aflac Japan breach is a useful case study in how differently regulators treat the same company depending on jurisdiction. Japan’s Financial Services Agency expects notification and a remediation plan but does not impose a fixed public-disclosure countdown, giving insurers a few days of breathing room to investigate before going public.
The United States runs on a patchwork instead. State breach-notification laws, which Aflac had to navigate for its 2025 US incident, set varying deadlines and required content for consumer letters. Layered on top of that, the SEC’s cybersecurity disclosure rule requires US-listed companies to report material incidents on Form 8-K within four business days of determining materiality, which is why a breach that never touched a single American customer record still produced a US regulatory filing within days of Aflac Japan’s internal investigation wrapping up.
5 Predictions for Aflac and the Insurance Sector
- More scrutiny from Japan’s FSA. A second Aflac breach inside two years makes a formal review or tightened reporting requirement for Japanese insurers more likely, even without a confirmed fine tied to this incident yet.
- US shareholder or consumer litigation risk rises. Plaintiffs’ firms that filed suits after the 2025 US incident now have a second data point to argue a pattern of inadequate security investment, even though this breach is based in Japan.
- Scattered Spider-style attacks keep spreading to mid-size insurers. The tactics require no custom malware, so smaller carriers without dedicated help-desk verification protocols are the likely next targets.
- Faster public disclosure becomes the norm in Japan. Aflac’s five-day turnaround from discovery to disclosure may set a new informal benchmark other Japanese financial firms feel pressure to match.
- Phishing-resistant authentication adoption accelerates. Expect more insurers to fast-track hardware security keys and passkeys for employee and help-desk verification specifically to blunt MFA-fatigue attacks.
How Affected Aflac Customers Can Protect Themselves
Anyone who holds an Aflac Japan policy, or who has family members that do, should treat the coming weeks as a heightened-risk window rather than wait for a letter to arrive. For context, US customers affected by the 2025 breach received letters from Aflac offering 12 months of free credit monitoring, with an enrollment deadline of April 18, 2026, according to The Record; Japan-based customers should expect a similar remediation offer once Aflac finalizes its notification letters:
- Review bank and insurance account statements for unauthorized transactions, especially around premium-payment dates
- Treat unsolicited calls, texts or emails referencing real policy numbers or coverage details as a red flag, not proof of legitimacy
- Change the password on any Aflac online account and avoid reusing that password anywhere else
- Enable phishing-resistant multi-factor authentication wherever Aflac or a linked financial account offers it
- Watch for the official notification letter Aflac has promised, and verify any follow-up contact through Aflac’s published customer service channels rather than a number provided in an unsolicited message
Research from Cloudflare has found that leaked or reused credentials are involved in a large share of successful account-takeover attempts, which is exactly why reusing an Aflac password anywhere else turns one breach into several. Readers who want a deeper comparison of authentication options can see Tech Insider’s passkeys vs passwords vs 2FA breakdown.
Frequently Asked Questions
How many people were affected by the Aflac Japan data breach?
Aflac Japan says 4.38 million customers and agents had personal information exposed after attackers accessed its systems between June 15 and June 25, 2026.
What data was stolen in the Aflac data breach?
Depending on the customer, exposed data includes names, addresses, phone numbers, dates of birth, gender, account security details, insurance policy information, and in some cases bank account details tied to premium payments.
Is this the same Aflac breach from 2025?
No. This is a separate incident affecting Aflac’s Japanese subsidiary in June 2026. Aflac’s US operations were hit by a different attack in June 2025, when the actor accessed personal information on June 12, 2025; Aflac’s own updates put the toll at roughly 22.65 million people as of December 2025 and said it had not identified any fraudulent use of the stolen information, but HIPAA Journal reported in February 2026 that the confirmed total had grown to about 26.5 million affected individuals once Aflac’s full OCR filings were counted.
Was Scattered Spider responsible for the Aflac Japan breach?
Aflac has not named an attacker for the 2026 Japan breach. Reporting has linked Aflac’s 2025 US incident, along with attacks on Allianz Life and other insurers, to the group known as Scattered Spider, but no confirmed technical attribution has been published for the 2026 Japan intrusion specifically.
Did the Aflac Japan breach affect US customers?
No. Aflac says the incident was contained to Aflac Japan’s systems and did not reach its US infrastructure or customer data.
What is Scattered Spider?
Scattered Spider, also tracked as UNC3944 or Octo Tempest, is a financially motivated hacking group known for social engineering, including impersonating IT staff to trick help desks into resetting passwords and multi-factor authentication, according to CISA’s public guidance on the group.
What should Aflac customers do after the breach?
Security guidance generally recommends watching bank and insurance statements for unauthorized activity, enabling phishing-resistant multi-factor authentication where available, and treating unsolicited calls or emails that reference real policy details with suspicion rather than trust.
Has Aflac faced any fines or lawsuits over the breach?
As of publication, no fine or lawsuit tied specifically to the 2026 Japan breach has been made public. Aflac Japan says it has notified Japan’s Financial Services Agency and other relevant authorities and plans to notify affected individuals by letter.
