Was It Breached Secria

Recent breaches

Aflac data breach: what leaked, and where the lawsuit stands

Aflac says an unauthorized actor took personal information from one of its systems on 12 June 2025. Its health data report to regulators covers 13,924,906 people.1,2

Return Mail Processing Center
P.O. Box 6336
Portland, OR 97228-6336

Date

Re: Notice of Data Breach

... Aflac determined on December 4, 2025 that your information may have been impacted in this incident.

Aflac is offering, free of charge, CyEx Medical Shield ... for 24 months. You must activate by Enrollment deadline to receive these services.

... please call the Aflac call center at 1-855-361-0305 (toll free) ...

  1. The return addressA processing center in Portland, Oregon, under the heading "Re: Notice of Data Breach".1
  2. Why it came in DecemberThe breach was in June 2025. Aflac says it determined in December whose information was involved.1
  3. The offerCredit monitoring, identity theft protection and medical fraud protection for 24 months. The deadline is printed per letter.1
  4. The call centerMonday to Friday 9 a.m. to 9 p.m. ET, and Saturdays 9 a.m. to 5:30 p.m. ET, per the sample.1

Drawn from the sample letter Aflac filed with California's attorney general. Checked 28 October 2026 against the sources.

The facts, as filed

"The company says" marks Aflac's own account. A listing here isn't a finding that the company was at fault.

What happened
The company says it detected suspicious activity on a limited number of its systems on 12 June 2025 and contained it within hours, and that an unauthorized actor obtained personal information that day.1
People affected
13,924,906 in Aflac's report to the HHS breach portal, as of 28 October 2026. That report covers health information.2 Its Texas filing, published 22 December 2025, counts 2,055,982 Texans.3 A Bloomberg Law report on the lawsuit puts the total at nearly 23 million.4
What leaked
Varies by person. The Texas filing lists names, addresses, Social Security numbers, driver's license and other government ID numbers such as passports, medical and health insurance information, and dates of birth.3
Monitoring offer
CyEx Medical Shield for 24 months, free. If you enrolled after Aflac's earlier message, the letter says your coverage stays active.1
Lawsuit
In re Aflac Inc. Data Breach Litigation, No. 4:25-cv-00183, in the U.S. District Court for the Middle District of Georgia. On 12 August 2026 Judge Clay D. Land let the negligence, implied contract and unjust enrichment claims go forward and dismissed some state-law claims.4 Aflac's August 2026 quarterly report says it has pending disputes over the incident and can't yet estimate the potential loss. We found no settlement as of 28 October 2026.5

One day in June, then a long tail

The dates come from Aflac's letter, its filings and the court's ruling.

  1. Aflac detects suspicious activity and contains it within hours.1

  2. Aflac determines whose information may be involved.1

  3. The sample letter is filed in California.1

  4. The court denies most of Aflac's motion to dismiss.4

What to do if you got an Aflac letter

Match the steps to the data your letter lists. The full checklist covers every data type.

  1. Activate the free monitoring before your deadline.IdentityTheft.gov says to accept free credit monitoring when a company offers it.1,6
  2. Social Security number listed: freeze your credit.While a freeze is in place, nobody can open a new credit account in your name. It's free to place and to lift.6
  3. Get an IRS identity protection PIN.The six-digit IP PIN stops someone else filing a tax return with your Social Security number.7
  4. Read your insurance statements.Aflac's letter suggests reviewing insurance statements for suspicious activity and contacting the company that holds the account.1

Questions people ask

Is there an Aflac data breach settlement?

We found none as of 28 October 2026. The case is past the motion to dismiss and continues, and Aflac's latest quarterly report describes the disputes as pending.4,5 A real settlement comes with a court-approved notice that names the case. This isn't legal advice.

Is the Aflac breach letter real?

Compare yours with the sample Aflac filed with California's attorney general: the Portland return address, the "Notice of Data Breach" heading and the CyEx Medical Shield offer.1 Call Aflac on a number you look up yourself if anything differs.6

Is this the same as the Aflac Japan incident?

No. Aflac reports a separate June 2026 incident at Aflac Japan and says its U.S. systems weren't accessed in it.5

Sources 7
  1. Aflac Incorporated: filing and sample notice (reported 19 December 2025), California Attorney General. Read 28 October 2026.
  2. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV. Read 28 October 2026.
  3. Data Security Breach Reports, Office of the Texas Attorney General. Aflac Incorporated, published 22 December 2025. Read 28 October 2026.
  4. "Aflac loses bid to dismiss lawsuit over massive 2025 data breach" (13 August 2026), Bloomberg Law, reprinted in a Robbins Geller news digest (PDF). Read 28 October 2026.
  5. Form 10-Q for the quarter ended 30 June 2026, filed 7 August 2026, Aflac Incorporated, via SEC EDGAR. Read 28 October 2026.
  6. What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach, IdentityTheft.gov, Federal Trade Commission. Read 28 October 2026.
  7. Get an identity protection PIN (IP PIN) (reviewed 4 August 2026), Internal Revenue Service. Read 28 October 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check