Aflac updates on June 2025 security incident

Aflac provided an update on a cybersecurity incident within its U.S. business that it first disclosed in June 2025, confirming that personal information tied to approximately 22.65 million individuals was involved.

The insurer said it detected suspicious activity on a limited number of systems and contained the incident within hours with the help of third-party cybersecurity experts, notifying federal law enforcement. Aflac emphasized that the incident did not involve ransomware and that its systems remained operational throughout.

Following detection, Aflac secured potentially affected accounts, reset passwords, and implemented enhanced monitoring. The company said it is not aware of any fraudulent use of personal information to date and will continue monitoring alongside third-party partners.

Aflac has completed a detailed review of the affected files and has begun notifying impacted individuals, outlining available support resources.