Aflac Japan Data Breach

Between 15 and 25 June 2026, attackers gained repeated unauthorised access to Aflac Japan’s customer portal (“Aflac Yorisou Net”) and related systems. The breach was detected on 25 June via elevated system load. Approximately 4.38 million customers had personal data exposed. Of these, roughly 230,000 also had premium payment bank account information (institution, branch, account type, number, and name) compromised. Agent/agency data was also affected. Aflac Japan blocked access and suspended related systems the same day. No evidence of subsequent misuse was reported at the time of disclosure.

Aflac Japan is a major provider of cancer and medical insurance in Japan, with a large policyholder base. The affected systems handled policy management, claims and premium payments.

Repeated unauthorised access to the policyholder portal and associated systems over an 11-day window. Exact initial access vector has not been publicly detailed.

No public attribution.

Additional victims

• Approximately 40,000 insurance agents/agencies

Countries affected

• Japan

Data types

• PII
• Names
• Dates of birth
• Gender
• Addresses
• Phone numbers
• Policy numbers
• Coverage details
• Bank account information (subset)

System outages affecting certain services; customer notification and support costs; regulatory reporting to Financial Services Agency and police.

Public reaction

Concern over exposure of banking details used for insurance premium payments; focus on detection delay.

Reported to Financial Services Agency and police; investigation ongoing at time of disclosure.

Security improvements

• Immediate blocking of access and suspension of related systems
• Engagement of external specialists for cause investigation and hardening

Significance

Significant insurance-sector breach in Japan involving millions of policyholders and a material subset of banking details used for recurring payments.

Publishing organisations

• Nikkei
• SecurityWeek
• Reuters
• The Japan Times

Access blocked and systems suspended on 25 June 2026. Investigation into root cause and full impact assessment continued after disclosure.

Official documents

• Aflac Japan official notice and FAQ (June–July 2026)
• SEC filing by parent company

References

1. [1]Aflac Japan official statements
2. [2]Nikkei
3. [3]SecurityWeek
4. [4]Reuters