Aflac Japan Confirms Breach of 4.38 Million Customers and Agents After Attackers Accessed Its Policyholder Portal
Aflac Life Insurance Japan says attackers accessed its policyholder portal between June 15 and 25, exposing personal data on roughly 4.38 million customers and agents.
Editor's Note ·
- Correction:
- The article attributes the statement that a year earlier Aflac disclosed a separate breach with indicators pointing to the Scattered Spider group to SecurityWeek. That reporting actually appears in BleepingComputer's article, not in the cited SecurityWeek report. The fact is accurate and sourced; the inline attribution named the wrong outlet.
- Clarification:
- The article attributes the detail that Aflac 'engaged outside cybersecurity specialists to investigate' to The Record. The Record reports the notifications to Japanese authorities and the SEC filing but does not mention outside specialists; that detail is reported by SecurityWeek and BleepingComputer. The fact is accurate and sourced; the inline attribution was imprecise.
Overview
Aflac Life Insurance Japan has disclosed a data breach that may affect roughly 4.38 million people after attackers gained unauthorized access to its policyholder portal. According to SecurityWeek, the intrusion began on June 15, 2026, continued through June 25, and was discovered on the same day it ended. The company announced the incident on June 30. The insurer said the compromise was confined to its Japanese operations and did not affect its U.S. business, as reported by BleepingComputer.
What We Know
The breach potentially affects “approximately 4.38 million customers and agents,” according to SecurityWeek, which reported that the attackers exfiltrated data from the company’s policyholder portal. The Record similarly put the figure at about 4.38 million policyholders.
The exposed personal data included “names, addresses, phone numbers, dates of birth, gender, security information, and insurance account information,” according to SecurityWeek. A smaller group of individuals had financial account details compromised: roughly 230,000 people had premium transfer account information exposed, as reported by SecurityWeek and The Record. No credit card information was accessed, according to SecurityWeek.
Aflac Japan said it moved to contain the intrusion once it was detected. “Upon identifying the unlawful access, Aflac Japan promptly took steps designed to contain the incident and prevent further intrusion, including suspending certain systems,” the company said, according to SecurityWeek. The insurer notified Japanese police and cybersecurity authorities, filed a notice with U.S. regulators, and engaged outside cybersecurity specialists to investigate, as reported by The Record.
The company emphasized that the event was isolated to Japan. “This incident is limited to systems in Japan, the Company’s systems related to its U.S. business were not accessed by the unauthorized third-party,” Aflac said, according to BleepingComputer.
What We Don’t Know
Aflac has not attributed the breach to any specific threat actor. According to The Record, the company “has not identified the attackers.” The full scope of the intrusion remained under investigation at the time of disclosure, and figures for those affected were described as preliminary estimates rather than confirmed totals.
This is not the first breach Aflac has disclosed. A year earlier, the insurer disclosed a separate data breach amid a broader wave of attacks on insurance companies, with indicators pointing to the Scattered Spider group, according to SecurityWeek. Whether the two events are connected has not been established.
Context
The disclosure landed alongside a cluster of unrelated cyber incidents at large Japanese companies. According to The Record, there is no evidence the attacks are connected, but the same period saw suspected unauthorized access at Sapporo Holdings’ overseas subsidiaries, a BlackField ransomware attack on Nidec’s Taiwanese subsidiary that included a $2 million demand, and unauthorized access to KDDI Corporation’s email system affecting five internet service providers through the exploitation of a third-party software vulnerability.