Aflac discloses extent of data breach: More than 22 million customers impacted
Aflac has announced personal information associated with approximately 22.65 million people was involved in a June 2025 security incident.
Aflac, the supplemental insurance company based in Columbus, says this is based on a review of potentially impacted files.
“Aflac detected suspicious activity on a limited number of its systems that prompted it to launch an immediate response with support from third-party cybersecurity experts, and to notify federal law enforcement,” the news release says.
The security incident was contained within hours, Aflac says, and their systems were not affected by ransomware and remained operational.
After the company detected the security incident, the news release says, Aflac “promptly secured accounts identified as potentially impacted and took additional steps, including resetting passwords and further monitoring for signs of suspicious activity.”
Aflac is not aware of any fraudulent use of personal information to date, according to the news release, and promises to continue to monitor any fraudulent activity along with third-party partners.
“Aflac has now completed a detailed review of the potentially impacted files, has begun the process of notifying individuals identified as impacted, and is detailing the resources we have made available,” the news release says.
In an email Wednesday, Aflac spokesman Jon Sullivan referred the Ledger-Enquirer to the company’s website in response to these questions:
- How many total customers does Aflac have?
- What categories of personal information are involved, such as social security numbers, DOBs, financial or medical, etc.?
- Aflac says it has begun the process of contacting affected customers. How is Aflac doing that (phone, email, etc.)?
- What are the “resources” Aflac is making available to those customers?
- By approximately what date does Aflac expect to be finished notifying all the customers whose personal information was exposed?
The Ledger-Enqurier didn’t see answers to those questions on Aflac’s website. Aflac’s LinkedIn account says it has over 50 million customers. So approximately 45% of its customers were impacted by this cyberattack.
In its June news release announcing the data breach, Aflac said it is offering “any individual who contacts our dedicated call center free credit monitoring and identity theft protection and Medical Shield for 24 months,” the news release says.
That phone is 855-361-0305.
The security incident and subsequent lawsuit
Aflac identified the suspicious activity on its United States computer network June 12, according to the company. The breach at Aflac was part of a hacking spree against the U.S. insurance industry, CNN reported at the time.
In June, a class-action lawsuit was filed in the Columbus Division of the U.S. District Court in the Middle District of Georgia by a lead defendant identified by the initials L.P., who lives in Kansas City.
The lawsuit alleges “failure to implement reasonable and industry standard data security practices to properly secure, safeguard, and adequately destroy Plaintiff and Class Members’ sensitive personal information that it had acquired and stored for its business purposes.”
The plaintiff seeks unspecified “compensatory damages, reimbursement of out-of-pocket costs, and injunctive relief including improvements to Defendant’s data security systems, future annual audits, as well as long-term and adequate credit monitoring services funded by Defendant, and declaratory relief.”
This story was originally published December 24, 2025 at 11:45 AM.