Aflac Japan Breach Exposes Data of 4.38 Million Insurance Customers

Aflac Life Insurance Japan disclosed that an unauthorized third party accessed its systems between June 15 and June 25, exposing data tied to about 4.38 million customers. The company said the compromised information included names, dates of birth, addresses, phone numbers, policy coverage details, and data related to insurance representatives and commercial agencies; roughly 230,000 records also contained bank account information. Aflac said the incident was limited to its Japan operations, that U.S. business systems were not accessed, and that affected systems were suspended after the intrusion was discovered on June 25.

The breach adds to a broader pattern of cyber incidents affecting Japanese organizations, where public reporting has shown hundreds of ransomware and extortion-related cases and frequent abuse of internet-facing systems such as VPN appliances and RDP. Research on disclosed incidents involving Japanese firms found that attackers often move quickly to leak or weaponize stolen data and increasingly time disruptive actions for nights or weekends, underscoring the operational pressure facing defenders. Aflac said it has brought in third-party cybersecurity experts and notified Japan’s Financial Services Agency and police, while stating that no confirmed misuse of the stolen data had been identified at the time of disclosure.