Aflac data breach in Japan hits 4.4M customers

Aflac data breach: 4.4M customers in Japan exposed

The Aflac data breach of 2026 hit Aflac Life Insurance Japan, not the U.S. business. An outside party got into two Japanese systems and pulled personal data on customers and sales agencies.

The company issued a first report on June 30 and a second on July 13. On July 31 it reported its investigation results and prevention plan to the Financial Services Agency, Japan's financial regulator.

The attacker was inside from June 10 to June 25

The first leak happened on June 10, and the attacker came back repeatedly until June 25. The problem surfaced at 6:30 a.m. on June 25, when Aflac Japan noticed an unusually heavy processing load on its servers. The parent company's SEC filing that week dated the intrusions from June 15, and the later investigation pushed the start back to June 10.

The first system, "Online Consultation," lets agencies design and sell policies remotely over tools such as Microsoft Teams. The second, "Aflac Yorisou Net," is a self-service site where policyholders check their contracts and update details like their address. Aflac Japan says internal and outside investigators found no similar leak from any other system.

Names, addresses and some bank details were exposed

Contact details and policy records leaked for about 4.4 million customers, and bank details for about 220,000 of them. What leaked depends on which system held a customer's records, so it differs from person to person. The table below covers the 4.4 million customers, counted by policyholder.

The "secondary contact" is a relative the policyholder named for emergencies, and that record includes the relative's name, birth date, address and phone number. The agency total also counts former agencies that no longer sell for Aflac.

U.S. Aflac customers were not affected

This incident stayed in Japan, and Aflac's U.S. systems were not reached. In its SEC filing, Aflac Incorporated said the attacker never got into systems tied to its U.S. operations. The parent also brought in outside cybersecurity specialists to help the Japanese unit.

Inside Japan, the affected group is wider than Yorisou Net users. Current policyholders and people whose policies have ended may both be on the list.

Aflac's defenses missed the attack because it looked like normal use

Aflac Japan's July 31 report blames weak controls over how the attacker logged in and queried data. Both systems had tools to spot and block intruders, but those tools did not flag this access.

Bulk data queries went unchecked

The attacker's sessions looked the same as a real user's, and nothing stopped them from pulling large amounts of data. The existing defenses treated the sessions as legitimate. The systems also lacked a way to watch for, and cut off, very large numbers of data lookups in a short period.

Aflac Japan had run security reviews when the systems were designed and penetration tests, meaning simulated attacks, before launch. Neither had accounted for this technique. The company has not said who the attacker was or exactly how the queries were made.

Four fixes Aflac has committed to

Aflac Japan has committed to four changes, from login checks to security staffing. The investigation report lists them as follows:

1. Tighter authentication when someone connects, and stricter checks on which data each user may query
2. Better monitoring and blocking of high-volume access in applications and security appliances
3. Stronger design reviews and penetration testing, with security requirements brought up to date
4. A broader overhaul of security management, including more staff and post-launch monitoring

Management is also taking a pay cut. The chairman and the president are each returning 30% of one month's pay, and two executives in charge of digital and risk are returning 20%.

Where the Aflac breach response stands in October 2026

By October 1, Aflac Japan had sent the leaked bank details to the banks and reopened its policyholder site. Its website explains both steps.

Leaked bank details were shared with banks

To help stop financial fraud, Aflac Japan began passing the leaked account details to the banks that hold those accounts. It shares the branch, account type, account number and account holder. For Japan Post Bank, the national postal bank, it shares the account symbol, number and holder.

The banks already hold this information, and Aflac Japan sends it so they can find the affected accounts. Banks are tightening fraud monitoring on them or considering doing so. Only accounts confirmed as leaked are included, and handling varies by bank.

Aflac Japan cites Article 27(1)(ii) of Japan's Act on the Protection of Personal Information and says the data may be used only to protect customers' assets. It checked with the Personal Information Protection Commission, the national privacy regulator, before sharing anything.

Yorisou Net is back online with two exceptions

Yorisou Net reopened on September 28 after Aflac Japan finished its fixes and safety checks. New users now go through a revised first-time registration, while existing users can keep their old ID and password. The company also recommends setting up a passkey.

Two procedures still cannot be done on the site. Both concern payouts or who receives them:

• Claims for support payments, celebration payments and long-term no-claim payments
• Registering or changing beneficiaries and designated proxy claimants

Both are still handled by the regular call center at 0120-5555-95. Aflac Japan has not said when Online Consultation, the agency tool, will come back.

Affected Aflac Japan policyholders should ignore unexpected contacts

No misuse has been confirmed so far, but the leaked details give scammers a convincing script. The safest response is to ignore unexpected contacts and check anything doubtful through the official helpline.

Watch for scam calls and text messages

Aflac Japan says the leaked data on its own is not enough for anyone to take money from your account. The real danger is a caller or text that uses your details to pose as Aflac, a bank, the police or a government office and talk you out of a PIN. The company asks policyholders to:

• Hang up on callers who rush you, for example by saying your account needs protecting
• Ignore links in text messages and use the official app or website instead
• Never share PINs, passwords or one-time codes with anyone
• Refuse any instruction to operate an ATM or send money
• Review your bank balance and transaction history regularly

Family members listed as insured persons or beneficiaries should get the same warning. If your PIN or password could be guessed from your name, birth date or phone number, Aflac Japan suggests changing it.

Aflac's dedicated helpline number and hours

The helpline for this incident is 0120-332-856. It is open 9:00 to 18:00 on weekdays and 9:00 to 17:00 on Saturdays, and closed over the New Year period and on public holidays. Call it if you get a suspicious message, spot a transaction you do not recognize, or want to change the bank account your premiums come from.

The apology letter lists which of your details leaked, explains what to watch for and gives the contact number. Aflac Japan's announcements as of October 1 do not mention compensation or any special handling for policy cancellations.

Your Yorisou Net password was not part of the leak, so changing it is optional. If you do want a fresh one, SOKUFU's password generator builds random passwords with the length and character types you choose.