AFLAC Japan has disclosed a breach that exposed the personal and financial details of approximately 4.4 million customers. The unauthorized access took place between 15 and 25 June, compromising names, addresses, policy information and bank account data for a subset of victims. The company said its United States operations remained unaffected.
According to filings with the U.S. Securities and Exchange Commission and statements posted on Aflac Japan’s maintenance notice, attackers were able to move laterally within the subsidiary’s network and exfiltrate data before detection on 25 June. No CVEs have been linked to the incident, suggesting the intrusion may have relied on compromised credentials or unpatched internal systems.
In response, Aflac Japan shut down several affected systems while maintaining claims processing through alternative channels. The firm has begun notifying impacted individuals and is offering identity‑protection services where appropriate. Investigations are ongoing to determine the full scope of the exfiltration and to identify any further malicious activity.
The breach adds to a series of security incidents affecting Aflac’s Japanese arm, raising fresh concerns about the resilience of insurers operating in the region. Industry observers note that the theft of bank transfer details for roughly 230 000 customers could enable targeted fraud schemes.
Defenders should review privileged access logs for unusual authentication patterns and enforce multi‑factor authentication on all remote‑access gateways. Customers are advised to monitor their bank statements for unexpected transactions and to be wary of unsolicited communications that reference policy numbers or claim details.
Aflac has pledged to cooperate with Japanese regulators and to update its security posture based on the findings of the ongoing inquiry. The incident serves as a reminder for insurers to segment critical financial systems and to conduct regular third‑party assessments of their Japanese subsidiaries.