Aflac Cybersecurity Breach Impacts Personal Data of 22.65 Million People in U.S. Business

Aflac Confirms Data Breach Scope

Insurance company Aflac (AFL) announced on Friday (Dec. 19) that a cybersecurity incident impacting its U.S. business involved the personal information of 22.65 million people. The disclosure provides a definitive figure following an initial report of the breach made by the company in June.

The 22.65 million figure represents the total number of individuals whose data was potentially compromised, determined after Aflac completed a thorough review of the affected files. This makes the incident one of the largest reported data breaches in the insurance sector this year.

Incident Background and Timeline

The cybersecurity event originated within Aflac's U.S. operations. While the initial report was made in June, the subsequent months were dedicated to forensic analysis to ascertain the full extent of the compromise, including identifying the specific files accessed and the individuals affected. The press release issued on Friday confirmed the final scope.

“The company determined the number of affected people after reviewing the potentially impacted files,” Aflac stated in its Friday press release.

Market and Sector Implications

For publicly traded companies like Aflac, large-scale data breaches often trigger scrutiny from regulators and may lead to significant remediation costs, including identity theft protection services for affected customers and potential legal liabilities. The insurance industry, which handles highly sensitive personal and medical records, remains a prime target for cyberattacks.

The scale of the breach—affecting over 22 million individuals—underscores the critical need for robust cybersecurity measures across the financial services sector. Investors often monitor such events closely, as they can impact consumer trust and operational expenses, potentially affecting the company's stock performance (AFL) in the near term.

Forward-Looking Steps

While the company has confirmed the number of affected individuals, further details regarding the specific types of personal information compromised (e.g., Social Security numbers, addresses, policy details) were not immediately provided in the available material. Typically, companies facing breaches of this magnitude offer credit monitoring and identity protection services to mitigate the risk of fraud for the affected population.