Aflac has confirmed a data breach that exposed sensitive personal and health information tied to about 22.6 million people. The company says it found the unauthorized access on June 12, 2025, and contained it within hours.
Aflac says the incident did not involve ransomware and did not disrupt core services like underwriting, claims processing, or customer support. The company first disclosed the breach publicly on June 20, 2025, while it continued its investigation.
What Aflac says happened
Aflac says attackers accessed a limited number of systems tied to its U.S. business. The company says it isolated affected systems quickly and began a review to understand which files the intruders accessed.
In December 2025, Aflac said it completed its file review and identified approximately 22.65 million individuals whose information appeared in the affected files. Many reports round that number to 22.6 million.
What information was exposed
Aflac says the involved files can include personal and health-related information, and the mix can vary by person. The company listed several categories that may appear in the files.
- Names and contact details
- Social Security numbers
- Claims information
- Health information
Reports based on state notification materials also describe exposure that may include dates of birth, home addresses, driver’s license numbers, other government-issued ID numbers, and health insurance information. Aflac says not every person had every data element in the involved files.
Timeline of key dates
- June 12, 2025: Aflac detects unauthorized access and says it contains the intrusion within hours.
- June 20, 2025: Aflac discloses the incident publicly in a regulatory filing.
- December 2025: Aflac says it completes its file review and identifies about 22.65 million impacted individuals.
What Aflac offers affected customers
Aflac is promising to provide 24 months of free protection through CyEx Medical Shield. The offering includes credit monitoring, identity theft support, and medical fraud protection.
Aflac listed an enrollment deadline of April 18, 2026, for eligible individuals. Customers should follow the instructions in Aflac’s notification to enroll.
Why this breach matters
The scale of the breach highlights how attractive insurance and health-related records remain for cybercriminals. Data tied to claims and health coverage can enable identity theft, medical fraud, and account takeovers.
What’s next
Aflac continues to strengthen security controls and review safeguards across affected systems. The breach may also draw attention from state regulators as notifications roll out and impacted customers report issues.
Customers who receive a notice should enroll in the offered protection, monitor credit reports and financial accounts, and review insurance statements for unfamiliar activity.
Discussion (0)
Be the first to comment.