2026 Aflac Japan — subsidiary breach; 4.38M customers/agents; bank data exposed
Data compromised
Policy and coverage details, personal information (names, addresses, phone numbers, dates of birth, gender, security details), insurance account information, and bank account information—scope varies by customer; Japan-only; U.S. Aflac systems not accessed
Technical writeup
Verified breach — disclosed June 30, 2026. Aflac Incorporated filed SEC Form 8-K stating wholly owned subsidiary Aflac Life Insurance Japan Ltd. discovered June 25, 2026 that an unauthorized third party unlawfully accessed certain Aflac Japan systems between June 15 and June 25, 2026. Aflac Japan suspended affected systems to contain the incident; several customer services remained unavailable during recovery. Investigation with external cybersecurity experts determined impacted files contain policy and coverage details, personal information, and bank account information. Aflac Japan notified the Japan Financial Services Agency and other authorities and intends to notify affected individuals by letter; no misuse of leaked information had been confirmed at initial disclosure. Trade press including BleepingComputer and SecurityAffairs cited approximately 4.38 million customers and agents affected via the Yoriso Net portal. The incident is limited to Japan; U.S. business systems were not accessed. Distinct from the December 2025 Aflac U.S. database breach (~22M records, aflac2025).
Root cause
Unauthorized third-party access to Aflac Life Insurance Japan Ltd. systems including the Aflac Yoriso Net policyholder portal, June 15–25, 2026; discovered June 25
References
- https://www.bleepingcomputer.com/news/security/insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack/
- https://www.sec.gov/Archives/edgar/data/4977/000162828026046124/afl-20260630.htm
- https://www.aflac.co.jp/info/yorisou_maintenance.html
- https://securityaffairs.com/194488/data-breach/hackers-steal-data-of-4-38-million-aflac-japan-customers.html