Attackers gained unauthorized access to Aflac Japan's systems over a ten-day period in June 2026, compromising sensitive personal and financial data. The company promptly contained the breach by suspending certain systems and is conducting an ongoing investigation with external experts. Notifications have been made to Japanese regulatory authorities and affected individuals. The breach is confined to the Japan subsidiary, with no impact on Aflac's U.S. systems. This incident follows a prior breach involving Aflac, associated with threat groups known for targeting insurance firms. No specific vulnerability or exploit details are provided, and no known exploits are reported in the wild.

The breach exposed sensitive personal information, policy and coverage details, and bank account information of Aflac Japan's customers. This could lead to privacy violations and potential financial fraud risks for affected individuals. The incident is limited to the Japan subsidiary and does not affect Aflac's U.S. operations. The full extent of the breach's impact on the company and its customers is still unknown as the investigation continues.

Aflac Japan has already taken containment actions by suspending affected systems and is working with external cybersecurity experts to investigate the incident. The company has notified relevant Japanese authorities and plans to inform affected individuals. No specific patch or fix is applicable as this is a breach incident rather than a software vulnerability. Organizations should monitor official communications from Aflac for updates and follow any guidance provided. No further immediate action is indicated based on the current information.