Aflac discloses data breach at Japan subsidiary after unauthorized access to customer information

American insurance company Aflac has disclosed a data breach affecting its Japan subsidiary after an unauthorized third party accessed company systems and obtained sensitive customer information.

The company said Aflac Life Insurance Japan Ltd., its wholly owned subsidiary, discovered the intrusion on June 25 after attackers unlawfully accessed certain systems between June 15 and June 25. The disclosure was made Monday in a filing with the U.S. Securities and Exchange Commission.

Aflac said it moved to contain the incident immediately after detecting the unauthorized access, including suspending certain systems to prevent further intrusion. Despite those measures, the company said Aflac Japan continues serving policyholders while responding to the incident.

The company is investigating the breach with assistance from external cybersecurity experts. The investigation has determined that some affected files contain policy and coverage details, personal information, and bank account information.

Aflac said it has notified the Japan Financial Services Agency and other relevant authorities about the incident. The company also plans to notify individuals whose information was affected.

The company said the breach was confined to systems in Japan and that systems supporting its U.S. business were not accessed. It added that the investigation remains ongoing and that the full scope and potential impact of the incident have not yet been determined.

The disclosure follows another data breach announced by Aflac one year earlier, when the company said attackers may have accessed documents containing sensitive information related to customers, beneficiaries, employees, agents, and other individuals. The company did not attribute that earlier incident to a specific threat group.