Aflac Discloses Data Breach at Japan Subsidiary After Unauthorized Access
Summary
Aflac said an unauthorized third party accessed Aflac Japan systems from June 15–25, 2026. Impacted files contained policy, personal and bank-account information; U.S. systems were not accessed. The investigation continues.
Key points
- Aflac reported unauthorized access to Aflac Japan systems between June 15 and June 25, 2026.
- Aflac said impacted files contained policy and coverage details, personal information, and bank-account information.
- The company said the incident was limited to Japan and its U.S. business systems were not accessed.
- Aflac Japan suspended certain systems to contain the incident while continuing to serve policyholders.
- Aflac Japan is investigating with external cybersecurity experts, notified Japanese authorities, and plans to contact affected individuals.
Article Details
- Victim Organization
- Aflac Japan
- Incident Type
- Data breach involving unauthorized access to systems and theft of sensitive information
- Incident Date
- 2026-06-15
- Disclosure Date
- 2026-06-30
- Data Types Exposed
- Policy and coverage details
- Personal information
- Bank account information
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Aflac Japan suspended certain systems to contain the incident and prevent further intrusion, while continuing to serve policyholders. The full scope and potential ultimate impact were not known.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Threat Actors
0ktapusThe article identifies 0ktapus as another name used to track Scattered Spider, which it links by signs to the previous year's Aflac breach; it does not attribute the June 2026 breach to this group.Scatter SwineThe article identifies Scatter Swine as another name used to track Scattered Spider, which it links by signs to the previous year's Aflac breach; it does not attribute the June 2026 breach to this group.Scattered SpiderThe article says the previous year's Aflac breach showed signs of a Scattered Spider attack; it does not attribute the June 2026 breach to this group.StarfraudThe article identifies Starfraud as another name used to track Scattered Spider, which it links by signs to the previous year's Aflac breach; it does not attribute the June 2026 breach to this group.UNC3944The article identifies UNC3944 as another name used to track Scattered Spider, which it links by signs to the previous year's Aflac breach; it does not attribute the June 2026 breach to this group.
Countries
JapanAflac disclosed that attackers breached Aflac Japan’s systems and stole sensitive policy, personal, and bank account information, while the company said its U.S.United StatesAflac disclosed that attackers breached Aflac Japan’s systems and stole sensitive policy, personal, and bank account information, while the company said its U.S.