AFL · 10-Q · 2026Q2 · Full report

Cybersecurity Incidents

AFLAC INC · 2026-08-07 · Importance 44 · Surprise 60 · In source text

Aflac reported a June 12, 2025 unauthorized-access incident affecting a limited number of U.S. systems and remains in communication with regulators and other authorities. Potential costs include credit monitoring, identity-theft protection, incident response, litigation, governmental investigations, possible enforcement actions, advisory services, higher cyber-insurance premiums, and compliance with evolving cybersecurity governance, monitoring, and disclosure requirements; the potential loss cannot currently be reasonably estimated. Separately, on June 25, 2026, an unauthorized third party accessed certain Aflac Japan systems, including files containing policy and coverage details, personal information, and bank account information. Aflac Japan notified the Japan Financial Services Agency and other relevant authorities and completed notifications to affected individuals, while the Company stated that the ultimate impact and potential loss remain unquantifiable.

Key facts

• As previously disclosed, on June 30, 2026, Aflac Japan issued a press release announcing that, on June 25, 2026, it had detected an unauthorized third-party had accessed certain Aflac Japan systems (the June 2026 Japan Cyber Incident). source
• Aflac Japan completed its investigation and determined that certain impacted files contain policy and coverage details, personal information, and bank account information. source
• Based on the information currently available, as of the date of this report, the Company believes that the potential amount of loss from the June 2026 Japan Cyber Incident cannot be reasonably estimated. source
• Based on the information currently available, as of the date of this report, the Company believes that the potential amount of loss from the June 2025 U.S. Cyber Incident cannot be reasonably estimated. source
• Aflac Japan has completed the notification process to individuals affected by the June 2026 Japan Cyber Incident. source
• The June 2026 Japan Cyber Incident is limited to systems in Japan and the Company’s systems related to its U.S. business were not accessed. source
• Based on the information currently available, as of the date of this report, the Company does not believe that the June 2025 U.S. Cyber Incident is reasonably likely to have a material impact on the Company’s financial condition or results of operations. source
• As previously disclosed, the Company identified an incident involving unauthorized access to a limited number of its systems in the U.S. on June 12, 2025 (the June 2025 U.S. Cyber Incident). source

Impact estimates