Loading story…
Aflac Life Insurance Japan disclosed that an unauthorized third party accessed its systems between June 15 and June 25, exposing data tied to about 4.38 million customers. The company said the compromised information included names, dates of birth, addresses, phone numbers, policy coverage details, and data related to insurance representatives and commercial agencies; roughly 230,000 records also contained bank account information. Aflac said the incident was limited to its Japan operations, that U.S. business systems were not accessed, and that affected systems were suspended after the intrusion was discovered on June 25.
The breach adds to a broader pattern of cyber incidents affecting Japanese organizations, where public reporting has shown hundreds of ransomware and extortion-related cases and frequent abuse of internet-facing systems such as VPN appliances and RDP. Research on disclosed incidents involving Japanese firms found that attackers often move quickly to leak or weaponize stolen data and increasingly time disruptive actions for nights or weekends, underscoring the operational pressure facing defenders. Aflac said it has brought in third-party cybersecurity experts and notified Japan’s Financial Services Agency and police, while stating that no confirmed misuse of the stolen data had been identified at the time of disclosure.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Aflac Japan disclosed that approximately 4.38 million customers were affected by the incident, including about 230,000 records containing bank account information. The company said the breach was confined to Japan and that no misuse of the stolen data had been confirmed at the time of disclosure.
On June 25, 2026, Aflac Japan discovered the intrusion, suspended affected systems, engaged third-party cybersecurity experts, and notified the Japan Financial Services Agency and police authorities.
Aflac Life Insurance Japan said an unauthorized third party accessed its Japanese systems during a breach window that began on June 15, 2026.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcesecurity.macnica.co.jp
Open sourcesecurity.macnica.co.jp
Open sourcesecurity.macnica.co.jp
Open sourcesecurity.macnica.co.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aflac disclosed that an unauthorized third party accessed certain systems at **Aflac Life Insurance Japan Ltd.** between June 15 and June 25, leading to a data breach affecting its policyholder portal and related services. The company said the incident was discovered on June 25, after which it contained parts of the intrusion, suspended some systems, and notified the Japan Financial Services Agency and other relevant authorities while continuing policyholder services where possible. Aflac said roughly **4.38 million** customers and agents were likely affected, with exposed information including names, addresses, phone numbers, dates of birth, gender, security information, and insurance account details. The insurer also said premium transfer bank account information for about **230,000** people was exfiltrated, though no credit card data was accessed; at least five Japan services were disrupted, restoration timelines remain unclear, and the company said the breach was limited to Japan systems and did not affect its U.S. business.
Aug 11, 2026
Aflac, the largest U.S. supplemental health insurance provider, has notified 22.65 million individuals that their sensitive health and personal information, including Social Security numbers, may have been compromised in a major data breach that occurred in June 2025. The incident, which Aflac described as part of a "sophisticated cybercrime campaign" targeting the insurance industry, is expected to be the largest health data breach reported to U.S. federal regulators in 2025 once official numbers are updated on the Department of Health and Human Services' HIPAA Breach Reporting Tool. Security researchers have speculated that the cybercriminal group Scattered Spider may be responsible for the attack, which coincided with similar incidents affecting other large U.S. insurers. Aflac initially reported the breach to the HHS Office for Civil Rights with a placeholder estimate of 500 affected individuals, but the updated figure of 22.65 million significantly increases the scale and impact of the incident. The breach highlights ongoing threats to the insurance sector and the potential for large-scale exposure of sensitive health data.
Jun 29, 2026
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to **14.22 million** email account records may have been exposed. The affected service supports KDDI and providers including **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE**. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures. The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**, and is coordinating customer notifications and password resets with the affected ISPs.
Jun 30, 2026