359/69 Thursday, July 2, 2026
Aflac Japan disclosed that attackers gained unauthorized access to the company’s systems between June 15 and June 25, 2026, and stole personal information belonging to approximately 4.38 million customers and agents. The data was stolen from the company’s policyholder portal, “Aflac Yoriso Net,” and other related systems. The information that may have been affected varies by individual and may include names, addresses, phone numbers, dates of birth, gender, security-related information, policy and coverage information, and some bank account details.
The company stated that it detected the incident on June 25, 2026, and quickly contained it by suspending the affected systems. It also launched an investigation with the assistance of external cybersecurity experts. Aflac Japan has reported the incident to Japan’s Financial Services Agency and other relevant authorities and is preparing to notify affected individuals by mail. The notifications will specify what information may have been exposed for each individual. The company has not found any evidence that information related to the incident has been misused.
Aflac stated that the incident was limited to Aflac Japan’s systems and did not affect its systems or operations in the United States. However, some customer services remain unavailable while the company continues system recovery and further impact assessments. The incident occurred amid a broader trend of attacks targeting insurance companies, including cases involving Allianz Life and attacks linked to the Scattered Spider cybercrime group. These incidents highlight the growing risks facing organizations in the insurance and financial services sectors.