Aflac Japan breach exposes 4.4 million customers’ insurance records and 220,000 customers’ bank details
Aflac Japan exposed personal and insurance information for about 4.4 million customers, including bank details for 220,000. Notification letters have been sent. Check bank transactions and verify unexpected calls or messages directly with Aflac.
If you or a parent held Aflac Japan insurance, check the notification letter or call Aflac Japan on 0120-332-856 to confirm what was exposed. Monitor bank transactions and verify unexpected calls or messages through Aflac’s official website or phone number; never disclose PINs, passwords or one-time codes. Portal users should enable a passkey under registration details → passwordless authentication settings.
What’s happening
Attackers accessed Aflac Japan’s customer portal and an agency consultation system between 10 and 25 June 2026. Approximately 4.4 million policyholders were affected; exposed records included personal details, policy numbers, cover information and information about insured people, beneficiaries and secondary contacts. Premium-payment bank-account details were exposed for about 220,000 customers, alongside information concerning about 40,000 agencies. Aflac says My Number identifiers, credit-card information, email addresses and portal login credentials were not exposed. Current and former customers could be affected even without registering for the portal. Notification letters were posted by 30 July. Aflac identified inadequate access controls and monitoring, strengthened security and resumed most portal services on 28 September, with some procedures still handled through its call centre. Its 1 October update said no misuse of the exposed information had been confirmed. The breach concerned Japan; Aflac said its US business systems were not accessed.
- What
- Breach
- Affects
- Aflac Japan insurance records, Yorisou Net customer portal and agency online consultation system
- Fixed in
- Nothing to patch
- Since
- 10 June 2026
- Closed
- 1 Oct 2026
Timeline
- Update
Aflac Japan said no misuse of the exposed information had been confirmed. Its updated FAQ described sharing affected account details with relevant banks to help prevent financial crime.
- Update
Most Yorisou Net services resumed after Aflac completed preventative measures and safety checks. Some procedures remained unavailable online.
- Vendor revised
The investigation confirmed approximately 4.4 million affected customers, including about 220,000 with bank-account details exposed, and information concerning about 40,000 agencies. Aflac revised the first access date from 15 to 10 June and identified insufficient access controls and monitoring of large data queries.
- Update
Aflac Japan completed posting notification letters to affected customers, having started on 10 July. The letters identified the information exposed for each customer.
- Made publicNothing to patch
Aflac Japan publicly disclosed the breach and reported it to police and regulators. Its initial figures were approximately 4.38 million customers, including about 230,000 whose premium-payment bank-account information was exposed.
- Update
Aflac Japan discovered the breach and blocked access, then suspended related systems to prevent further exposure.
- Update
Unauthorised access began, according to Aflac Japan’s subsequent investigation. Access occurred repeatedly through 25 June.
Sources
- Unauthorised access and information disclosure: customer FAQAflac Japan · 1 Oct 2026
- Investigation results and measures to prevent recurrenceAflac Japan · 31 July 2026
- Apology and notice concerning unauthorised access and information disclosureAflac Japan · 30 June 2026
- Incident notice and Yorisou Net service availabilityAflac Japan · 1 Oct 2026
- Yorisou Net service restart and passkey setup guidanceAflac Japan
- Insurance giant Aflac discloses data breach after subsidiary hackBleepingComputer · 30 June 2026
- Aflac breach investigation identifies insufficient monitoring and controls for large data queriesScanNetSecurity · 20 Aug 2026