Corrected on 1 October 2026
We claimed there were signs the breach was the work of the same attacker group. That isn't in any official source and was removed. In its place we added the access dates (15 to 25 June) from Aflac's 8-K filing with the SEC and the figure of about 4.38 million affected customers from Aflac Japan's statement, as cited by MLex. The conclusion about the scale doesn't change.
A big name isn't armor against a breach. Sometimes it's the opposite - it makes you a bigger target. Aflac showed exactly that: unauthorized access through its Japanese subsidiary and leaked data on millions of customers - policies, personal data, bank accounts. The US systems stayed unaffected, but in Japan the scale is large.
Fact
The facts: the access window ran for about ten days in June. According to Aflac's report to the SEC, the access ran from 15 to 25 June. According to Aflac Japan, as cited by MLex, about 4.38 million customers were affected. There is no CVE: the company reports unauthorized access to its systems, not a flaw in a specific piece of software.
Insurers hold the most sensitive data there is - health, finances, identity. That's why they're a constant target. A breach there costs far more than a breach at a shoe store.
And the entry rarely goes through headquarters. It goes through a subsidiary or a partner - through the weaker link, not the locked door. That's it.
Sources
Aflac Incorporated - Form 8-K to the SEC on the unauthorized access at Aflac Japan, 30.06.2026MLex - Japan's Aflac Life Insurance reports data breach affecting 4.38 million customers (based on Aflac Japan's official statement)The visual is generated code-art, no third-party images.