Aflac Japan subsidiary portal breach — 4.38M policyholders/agents

Aflac Incorporated filed an SEC Form 8-K on 2026-06-30 disclosing that attackers held unauthorized access to Aflac Life Insurance Japan's policyholder web portal for roughly ten days (2026-06-15 to 2026-06-25) and exfiltrated personal data on approximately 4.38 million customers and agents — names, addresses, phone numbers, dates of birth, gender, authentication details and insurance-account information; a subset of roughly 230,000 individuals also had premium-transfer bank-account details exposed, and no card data was accessed (SecurityWeek, 2026-06-30 · SEC EDGAR 8-K, 2026-06-30). Aflac says the intrusion was contained to Japan-subsidiary systems with US operations unaffected, the affected systems were suspended on discovery, and Japan's Financial Services Agency was notified (BleepingComputer, 2026-06-30). No initial-access vector or actor attribution is stated in any of the disclosures; this is Aflac's second disclosed breach in roughly a year, but the prior US incident's Scattered-Spider-adjacent framing has not been extended to the Japan event.

Defender takeaway: the operationally relevant fact is the ~10-day undetected dwell inside a customer-facing portal exfiltrating bulk PII — a pattern to hunt for as sustained anomalous authenticated-session data pulls / API enumeration against public benefits, insurance or citizen-services portals, not a patchable CVE. No IOC or CVE was disclosed; treat as an access-pattern anomaly cue.