Aflac Reports Massive Data Breach Affecting Over 22 Million Users in June

Share and Follow

In Columbus, Georgia, Aflac has disclosed that a comprehensive investigation revealed a data breach affecting the personal information of approximately 22.65 million individuals earlier this year.

In June, Aflac acknowledged that hackers potentially accessed sensitive data, including Social Security numbers, insurance claims, and health information, as reported by Nexstar’s WRBL. The compromised data includes names, contact details, health records, and Social Security numbers.

According to Aflac, unusual activity was identified on its network in June. Upon detection, the company quickly activated its cybersecurity protocols and managed to halt the breach within hours.

Nexstar’s The Hill reported that Aflac believed social engineering techniques were used to infiltrate and acquire the sensitive data.

Aflac has since completed its review of the incident and found that “personal information associated with approximately 22.65 million was involved.”

In a press release days before Christmas, Aflac said it has started notifying those impacted, including customers, beneficiaries, employees, agents, and “other individuals related to Aflac.” Those individuals will be offered free credit monitoring, identity theft protection and Medical Shield for 24 months. These same services were offered to customers who called Aflac after the company revealed the data breach in June.

If you were impacted, you have until April 18, 2026, to enroll in those services, according to Aflac. The company says you can register for the resources by calling its call center at 1-855-361-0305, Monday through Friday from 9 a.m. to 9 p.m. ET, and from 9 a.m. to 5:30 p.m. ET on Saturdays. The call center is not available on major U.S. holidays.

If you previously enrolled in CyEx Medical Shield after learning of the breach, you do not need to re-enroll.

Aflac said it has not learned of any fraud related to the information obtained in the “security incident.”

“If you identify suspicious activity, you should contact the entity that maintains the information on your behalf,” a statement issued by the company indicated.