Aflac Incorporated reported that its wholly owned subsidiary, Aflac Life Insurance Japan Ltd., discovered on June 25, 2026 that an unauthorized third-party had unlawfully accessed certain Aflac Japan systems between June 15 and June 25, 2026. After detecting the breach, Aflac Japan suspended certain systems to contain the incident but continues serving policyholders.
The company has begun an investigation, engaged external cybersecurity experts, and determined that some affected files include policy and coverage details, personal data, and bank account information. Aflac Japan has notified the Japan Financial Services Agency and other authorities and plans to notify impacted individuals. The incident is limited to systems in Japan, and U.S. business systems were not accessed. The full scope and potential impact have not yet been determined.
Aflac reports a Japan-only cyber breach with sensitive data exposure and unresolved impact.
Aflac Japan identified unauthorized access to certain systems over a 10-day period in June 2026. The company reports exposure of policy and coverage details, personal information, and bank account data, which raises potential customer, regulatory, and financial implications.
The incident is currently confined to systems in Japan, with U.S. business systems not accessed, which limits immediate geographic spread of operational risk. Aflac has engaged third-party cybersecurity experts, notified the Japan Financial Services Agency and other authorities, and plans notifications to affected individuals, aligning with regulatory expectations.
Actual financial, legal, and reputational impact depends on the ongoing investigation, potential regulatory inquiries or enforcement actions, litigation, contract disputes, or loss of business described in the company’s own cautionary language. Future company disclosures will clarify the scope of data compromised and associated costs as the investigation progresses.
Source: View Original Filing on SEC EDGAR
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
