Aflac confirms June data breach affecting over 22 million customers

Aflac has confirmed a June data breach affecting more than 22 million customers, with personal information including names, contact details, claims and health information, and Social Security numbers involved for some individuals. The company said suspicious activity was detected on a limited number of systems in June, but the incident was contained within hours and no ransomware was involved, with affected accounts secured and passwords reset.

Aflac is offering two years of identity protection services, including CyEx Medical Shield, with an enrollment deadline of 18 April 2026 and ongoing monitoring for signs of suspicious activity. The firm noted that not all data types affected every individual, but the breach affected customers, employees, agents and others. The company described that it has notified the impacted individuals and is providing resources and support via a dedicated call centre line. According to Reuters, Aflac is among several insurance firms hit in 2025 by cyberattacks, in a wave linked to the cybercrime group Scattered Spider.