On June 12, 2025, Aflac discovered suspicious activity on its United States network. According to the company, cyber incident response protocols were initiated, and the intrusion was halted within hours of discovery. 

At this time, the business remains operational. The organization can review claims, underwrite policies and serve customers as usual. 

The organization states that this attack was the responsibility of a cybercrime organization that has been targeting the insurance sector, which the Google Threat Intelligence Group has warned about previously. 

While an investigation into the cyber incident is ongoing, the company has shared some preliminary findings: 

• A social engineering attack was likely the cause of this attack, enabling the malicious actor to gain access to the network. 
• Potentially affected files include claims information, health information, Social Security numbers and more. 
• The personally identifiable information (PII) related of customers, beneficiaries, employees, agents or others may be at risk.
• Currently, it is unclear how many individuals may be impacted by this event. 

The company states that it will provide more information as the investigation continues.