Did Aflac Have a Security Breach

Yes. Aflac reported a cyberattack, also described as a security incident, in June 2025. The incident was reported to the U.S. Department of Health and Human Services Office for Civil Rights because health-related information may have been involved.

The confusing part is the number of people affected. Different reports list different totals, from at least 13.9 million people to more than 20 million, including one figure of 22.6 million. Those numbers shouldn’t be treated as interchangeable. They may reflect different reporting stages, different types of information, or different ways of counting affected people.

Here’s what’s known, what remains unclear, and what to do if you received an Aflac security incident letter.

Yes—Aflac reported a June 2025 cyberattack and security incident

The available reports describe a cyberattack against Aflac in June 2025. Aflac later updated its public information about the incident in December 2025.

Aflac’s December update said:

• The incident was contained within hours.
• Ransomware was not involved, according to Aflac.
• The incident did not affect the operation of Aflac’s systems.
• Personal information was likely included in the data involved.

That last point matters. An incident can leave systems running while still exposing information stored in or accessible through those systems.

Aflac also reported the incident to the HHS Office for Civil Rights. That filing points to the possible involvement of protected health information, often called PHI. PHI is health information connected to an identifiable person, such as a policyholder or someone covered under a health plan.

So, was Aflac hacked recently? Based on the reported June 2025 event, yes. But “hacked” is a broad everyday term. Aflac’s own wording focused on a security incident, while reports described it as a cyberattack.

What the available reports say about the number of people affected

Search results show several different figures:

• One report says the PHI of at least 13.9 million individuals was involved.
• Other reports say more than 20 million people were affected.
• Another reported figure is 22.6 million people.

It would be misleading to pick one number and present it as the final answer without explaining the difference.

The 13.9 million figure appears tied to the number of people whose protected health information may have been involved. The larger totals may cover a wider group of people or a later estimate of the incident’s reach. The available material does not establish that all reports are counting exactly the same records or people.

There may also be a difference between an early estimate and a later update. Breach investigations often take time because a company has to review files, systems, and records before it can identify who may have been affected. Still, the information provided here does not confirm which figure Aflac considers the final total.

For now, the safest way to describe the situation is:

> Reports say the incident may have affected millions of people, with figures ranging from at least 13.9 million to 22.6 million, depending on the report and the type of information counted.

That wording avoids turning conflicting reports into one unsupported number.

What types of information may have been involved

The reports describe several categories of potentially affected information:

• Personal information
• Medical information
• Health insurance information
• Protected health information, or PHI

Aflac reportedly confirmed in early December that personal data was likely included in the June incident. The HHS reporting connection relates to possible health information.

The available material does not provide a complete, confirmed list of every data field involved. It also does not establish that every person connected with Aflac had the same information exposed.

That distinction is important. A person who receives an Aflac policy through work, for example, may not have the same type of information involved as another person who submitted medical or insurance details. Your own notice, if you received one, should explain what Aflac believes applies to you.

Don’t assume that an online account password, medical record, Social Security number, or payment information was exposed unless your notice or an official Aflac channel says so.

Was the incident contained, and was ransomware involved?

Aflac’s December 2025 update said the security incident was contained within hours. It also said the event did not involve ransomware and did not affect system operations.

Ransomware is a type of attack in which criminals lock or encrypt systems and demand payment. A statement that ransomware was not involved does not mean no information was accessed or copied. It only addresses that particular type of attack.

Likewise, saying that operations were not affected does not answer every question about personal information. A company can continue serving customers while it investigates whether data was accessed.

The available reports do not give enough detail to independently explain exactly how the attackers entered the systems or what they did. It’s best to stick to the details Aflac reported rather than guess about the technical cause.

How to check whether you may have been affected

There does not appear to be a confirmed public lookup tool in the information available here. That means you may not be able to type your name into a public page and get an instant answer.

Use this process instead:

1. Look for an Aflac security notice. Check paper mail and digital messages connected with your Aflac coverage. If your benefits come through an employer, check the benefits messages or documents your employer provides too.
2. Read the notice closely. Look for the incident date, the type of information Aflac says may have been involved, and any instructions meant for you.
3. Find the official Aflac security incident website. Use a trusted Aflac account channel or Aflac’s official website to locate it. Don’t rely on an unfamiliar link sent in a random email or text.
4. Use the details in the notice only after verifying the page. A real notice may include a reference number or instructions, but the material available here does not confirm a standard format.
5. Contact Aflac through a trusted channel if the notice is unclear. Use contact information from your existing account documents or the official Aflac website, not only the phone number or link in an unexpected message.

If you haven’t received a notice, that does not let you confirm either way whether your information was involved. It simply means you should avoid making assumptions. The available reports do not provide a definitive public method for checking every person’s status.

How to tell if an Aflac breach letter is real

Aflac security incident letters can be confusing, especially when you weren’t expecting one. Search results also show people asking whether an Aflac security incident letter is legitimate.

The safest approach is to verify the message separately instead of trusting every detail inside it.

Check for these basic warning signs:

• The letter or email asks for a password, banking login, or other sensitive information.
• It pressures you to act immediately or threatens a penalty.
• It sends you to a strange domain or shortened web address.
• The message contains unexpected attachments.
• The contact details don’t match the official Aflac account or website you normally use.
• It promises money, benefits, or identity protection without clear confirmation through an official Aflac channel.

A polished letter can still be fake, so appearance alone isn’t proof. At the same time, don’t assume a notice is fraudulent just because the affected-person totals in news reports are confusing.

To check an Aflac security incident website or login safely, start from a trusted Aflac account or manually find Aflac’s official website. Avoid clicking the link in the message until you’ve verified where it leads. If you have coverage through an employer, you can also check whether your benefits team has shared a related notice—but don’t treat an employer message as a substitute for verifying the official Aflac information.

What to do if you received an Aflac security notice

First, keep the notice. Save a paper copy or a digital copy, including any reference number and the date you received it.

Then read what the notice says about:

• The information that may have been involved
• The dates connected with the incident
• Any steps Aflac asks you to take
• Any official website or account instructions
• How to get more information through a trusted channel

Don’t invent a deadline or assume you need to enroll in a service unless the notice clearly says so. The available information does not establish a universal enrollment deadline, compensation offer, or identity-monitoring program for all recipients.

If the notice suggests changing a password, change it through the official Aflac account channel. Don’t reuse that password on other websites. If you used the same password elsewhere, update those accounts through their own official sites too.

Watch your accounts and statements for activity you don’t recognize. Pay attention to health insurance or medical claims information as well as financial accounts, since the reports mention personal, medical, health insurance, and protected health information.

If you think the notice is a scam, don’t reply through the message or use its links. Verify it through the official Aflac security incident website or a trusted Aflac account channel.

What is known about the Aflac class action lawsuit?

One report says a class action lawsuit was filed against Aflac after the security incident.

That does not establish the lawsuit’s outcome, the claims being made, or whether every person who received an Aflac notice is included. The available information also does not confirm the case’s current status, eligibility rules, deadlines, or any payment.

Be careful with websites that ask for money or sensitive information before explaining the case. Don’t assume that a letter about the security incident automatically means you are part of a lawsuit. Legal notices and security notices are different things.

If you want to know whether a case applies to you, check current court records or official legal information. For questions about your own rights, a qualified lawyer can explain your options.

The June 2025 Aflac incident is real according to Aflac’s reported update and the related regulatory reporting. The affected-person totals remain different across reports, so your own notice is more useful than a headline number. Verify that notice, the incident website, and any next steps through Aflac’s official website or a trusted account channel—not through an unfamiliar message.