Breach taxonomy
Summary
Aflac Life Insurance Japan discovered on June 25, 2026 that an unauthorized third party had unlawfully accessed certain of its systems between June 15 and June 25, 2026. Impacted files contain policy and coverage details, personal information, and bank account information. Aflac Japan suspended certain systems to contain the incident while continuing to serve policyholders, and notified the Japan FSA. The incident is limited to Japan; US systems were not accessed. Filed under Item 8.01; separate from Aflac's June 2025 US incident.
Tagging rationale
ThreatUnknown
Filing refers only to 'an unauthorized third-party' with no attribution -> UNKNOWN.
MethodsData Exfil
An unauthorized third party 'unlawfully accessed certain of Aflac Japan's systems' over a ten-day window with impacted files containing customer data -> DATA-EXFIL.
AssetsPersonal Data
Filing states 'certain impacted files contain policy and coverage details, personal information, and bank account information' -> PERSONAL-DATA.
EffectsInfo Privacy Loss
Primary disclosed effect is compromise of policyholder personal and bank account information; certain systems were suspended for containment but service to policyholders continued -> INFO-PRIVACY-LOSS.
Business continuityEffective
Aflac Japan suspended certain systems for containment yet 'continues to serve its policyholders as it responds to this incident' -> Effective.
Impact
Ten-day intrusion at a major insurer's Japan segment with policyholder personal and bank account data in impacted files, full scope unknown -> score 3.
InsuranceNot disclosed
Filing makes no mention of cyber insurance coverage for this incident -> null.
Read the original SEC filing excerpt
On June 30, 2026, Aflac Life Insurance Japan Ltd. ("Aflac Japan"), a wholly owned subsidiary of Aflac Incorporated, a Georgia corporation (the "Company"), issued a press release announcing that, on June 25, 2026, Aflac Japan discovered an unauthorized third-party had unlawfully accessed certain of Aflac Japan's systems between June 15, 2026 and June 25, 2026. Upon identifying the unlawful access, Aflac Japan promptly took steps designed to contain the incident and prevent further intrusion, including suspending certain systems. Notwithstanding the suspension of certain systems, Aflac Japan continues to serve its policyholders as it responds to this incident. Aflac Japan has launched an investigation into the matter, which remains ongoing, and the Company has engaged third-party cybersecurity experts to support Aflac Japan's response to the incident. Although the investigation remains ongoing, Aflac Japan has determined that certain impacted files contain policy and coverage details, personal information, and bank account information. Aflac Japan has notified the Japan Financial Services Agency and other relevant authorities, and intends to provide appropriate notifications to individuals affected by this incident. This incident is limited to systems in Japan, the Company's systems related to its U.S. business were not accessed by the unauthorized third-party. At this time, the full scope and potential ultimate impact on the Company are not known.