Aflac
Disclosed Jun 20, 20251 year ago22,653,844 affectedConfirmed
Aflac hack exposes SSNs and health data of 22.65 million people
Aflac identified unauthorized network access on June 12, 2025 amid Scattered Spider attacks on insurers, and in December said it was notifying about 22.65 million people whose SSNs, ID numbers and medical and insurance data were stolen.
What is known
| People affected | 22,653,844 (as reported by the organization) |
|---|---|
| Disclosed | Jun 20, 2025 |
| Discovered | Jun 12, 2025 |
| Happened | Jun 12, 2025 |
| Attack | Hacking |
| Data exposed | Names, Health, Insurance, Dates of birth, Addresses, Government IDs, Social Security numbers |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Aflacoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Aflacatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Aflacattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Aflacjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: Aflac (Health Plan, GA)ocrportal.hhs.gov · Official notice | Official notice |
| US insurance giant Aflac says customers' personal data stolen during cyberattacktechcrunch.com · News | News |
| US insurance giant Aflac says hackers stole personal and health data of 22.6 million peopletechcrunch.com · News | News |
| Aflac Form 8-K Item 8.01sec.gov · SEC filing | SEC filing |
| Texas Attorney General data security breach report BR-0004744: Aflacoag.my.site.com · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Jun 20, 2025 | |
| Researchtotal | Jun 20, 2025 | 22,650,000 |
| SEC 8-K 8.01total | Jun 20, 2025 | |
| Washington AGresidents of WA | Jul 11, 2025 | 432,025 |
| Oregon DOJresidents of OR | Jul 11, 2025 | 1 |
| HHS OCRtotal | Aug 8, 2025 | 13,924,906 |
| California AGresidents of CA | Dec 19, 2025 | |
| Texas AGresidents of TX | Dec 22, 2025 | 2,055,982 |
Other breaches at Aflac
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Mar 1, 2021Mar 1, 20215 years ago | Mar 1, 20215 years ago | Not stated | Insurance | Confirmed | 2,635 |
| Disclosed Dec 16, 2019Dec 16, 20196 years agoInsider | Dec 16, 20196 years ago | Insider | Insurance | Confirmed | 1,601 |
| Disclosed May 29, 2018May 29, 20188 years agoHacking | May 29, 20188 years ago | Hacking | Insurance | Confirmed | 10K |
| Disclosed May 20, 2016May 20, 201610 years agoInsider | May 20, 201610 years ago | Insider | Insurance | Confirmed | 930 |
| Disclosed May 15, 2015May 15, 201511 years agoInsider | May 15, 201511 years ago | Insider | Insurance | Confirmed | 6,166 |
| Disclosed Jan 15, 2014Jan 15, 201412 years ago | Jan 15, 201412 years ago | Not stated | Insurance | Confirmed | 1 |
History of this record
- 2026-09-25 · records: 22650000 to 22653844 · backfill source
- 2026-09-25 · data_types: ["names","health","insurance"] to ["names","health","insurance","dob","addresses","government-id","ssn"] · seed source
- 2026-09-25 · records_basis: hhs to organization · seed source
- 2026-09-25 · records: 13924906 to 22650000 · seed source
- 2026-09-25 · summary: empty to Aflac identified unauthorized network access on June 12, 2025 amid Scattered Spider attacks on insurers, and in December said it was notifying about 22.65 million people whose SSNs, ID numbers and medical and insurance data were stolen. · seed source
- 2026-09-25 · title: empty to Aflac hack exposes SSNs and health data of 22.65 million people · seed source
- 2026-09-25 · sector: other to insurance · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 13924906 · backfill source
- 2026-09-25 · data_types: [] to ["names","health","insurance"] · backfill source
- 2026-09-25 · disclosed: 2025-07-11 to 2025-06-20 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · disclosed: 2025-12-19 to 2025-07-11 · backfill source
- 2026-09-25 · discovered: empty to 2025-06-12 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.