Aflac Japan Suffers Second Major Data Breach in 13 Months, Exposing 4.38 Million Customers Aflac’s Japanese subsidiary, Aflac Life Insurance Japan Ltd., disclosed a cyberattack on June 30, 2026, revealing that hackers accessed its systems for ten days from June 15 to June 25 before detection. The breach compromised the personal data of 4.38 million customers, marking the second major cyber incident for the insurance giant in just over a year. ### Scope and Impact of the Breach The attack targeted Aflac Yoriso Net, the company’s customer portal, along with connected systems. Exposed data includes: - Personal identifiers: Names, addresses, phone numbers, dates of birth, and gender - Account details: Security credentials and insurance policy information - Financial data: Bank account numbers for a subset of customers Aflac confirmed that no misuse of the stolen data has been detected, though the company is still mapping the full extent of the exposure. Affected individuals will receive notification letters once the investigation concludes. ### Timeline of the Attack - June 10–15, 2026: Earliest reported unauthorized access - June 15–25, 2026: Confirmed intrusion window - June 25, 2026: Aflac Japan discovers the breach, suspends affected systems - June 25–30, 2026: Internal investigation with third-party cybersecurity experts - June 30, 2026: Public disclosure via SEC filing and Japanese customer notice The five-day gap between discovery and disclosure aligns with Japan’s regulatory framework, which does not impose a fixed public notification deadline like the EU’s GDPR. ### Regulatory and Legal Fallout As a U.S.-listed company, Aflac filed a Form 8-K with the SEC, emphasizing that the breach was confined to its Japanese operations. The company also notified Japan’s Financial Services Agency (FSA), though no fines or enforcement actions have been announced. The incident follows Aflac’s 2025 U.S. breach, which exposed 22.65 million records five times the scale of the Japan attack through a social engineering attack. While Aflac has not attributed the 2026 breach to a specific group, reporting links the 2025 incident to Scattered Spider, a cybercrime collective known for targeting insurers via MFA fatigue and help-desk impersonation. ### Broader Industry Implications The breach underscores persistent vulnerabilities in the insurance sector, where decentralized IT systems and high-pressure customer service environments create opportunities for social engineering attacks. With Scattered Spider and similar groups actively targeting insurers, the incident raises questions about the effectiveness of existing defenses, even for well-resourced companies. Aflac’s stock has not shown a confirmed reaction to the disclosure, but the reputational and legal risks remain significant. The company’s $17.16 billion in 2025 revenue and 50 million policyholders in Japan make it a prime target, and the breach could accelerate regulatory scrutiny in Japan and beyond. ### Comparison to Other 2026 Breaches While substantial, the Aflac Japan breach is smaller than some of 2026’s largest incidents, including: - KDDI (Japan): 12.2 million email addresses and 7.6 million passwords exposed via a third-party zero-day - AT&T (2024): 73 million records leaked, leading to a $177 million class-action settlement The Aflac breach’s inclusion of bank account details heightens the risk of follow-up fraud, particularly through phishing and unauthorized withdrawals. ### Unanswered Questions - Attribution: No group has been officially named, though circumstantial evidence points to Scattered Spider’s playbook. - Financial Impact: Aflac has not disclosed potential costs, but litigation and remediation expenses could align with the $4.44 million global average for data breaches (per IBM’s 2025 report). - Long-Term Response: The FSA may tighten reporting requirements for Japanese insurers, while U.S. regulators could scrutinize Aflac’s security posture in future filings. The incident serves as a reminder of the insurance sector’s appeal to cybercriminals and the challenges of defending against attacks that exploit human, rather than technical, vulnerabilities.