Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)CriticalContained

AFLAC INCORPORATED

bd_2c6b0987aa912328 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 12, 2025

Filed

Jul 11, 2025

To disclose

29 days

Affected

432,025state residents only

Linked

6 filings

Confidence

69%

Full breach record for AFLAC INCORPORATED →18 incidents on file

Aflac Incorporated reported a security incident to the Washington Attorney General on December 19, 2025, supplementing a June 2025 notice. The incident, discovered on June 12, 2025, involved unauthorized access via social engineering/phishing. Approximately 432,025 Washington residents were affected, with data including names, SSNs, DOBs, and PHI. Aflac contained the incident, engaged forensic experts, notified law enforcement, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d29 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 29 days

Jun 12, 2025

Begins

Jun 12, 2025

Discovered

Jun 20, 2025

Scope determined

Jul 11, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Oregon State AGbd_aca1f25de70724162025-07-11Verified
South Carolina State AGbd_d73fac9930b96b8a2025-07-14 · +3dVerified
Illinois State AGbd_976e5c43783ad1922025-07-01 · +10dVerified
Delaware State AGbd_914dcca03fa76b502025-06-20 · +21dVerified

Show 1 more filing ↓up to 21d gap

SEC 8-Kbd_b044b84c4e40b4a42025-06-20 · +21dVerified

Name: HOGAN LOVELLS US LLP
norm: hogan lovells us

Name: AFLAC INCORPORATED
norm: aflac
Domain: aflac.com
Industry: Financial Servicesllm

Discovered: Jun 12, 2025
Breach occurred: Jun 12, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: Jun 20, 2025
Notification sent: Dec 19, 2025
Affected individuals: 432,025state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: NameSocial Security numberDate of birthHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notify federal law enforcement
Initial access: phishing_link

During the incident: Launched an immediate response and investigation with support from third-party cybersecurity experts
Notify federal law enforcement
Locked accounts identified as impacted
Resetting passwords
Further monitoring for signs of suspicious activity
Established a dedicated call center to answer questions from customers
Offering CyEx Medical Shield, which includes credit monitoring, identity theft protection, medical fraud protection, and customer support, for 24 months
Changes made: Offering CyEx Medical Shield, which includes credit monitoring, identity theft protection, medical fraud protection, and customer support, for 24 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Delaware State AGJun 20 · first

SEC 8-KJun 20 · first

Illinois State AG+11d

Oregon State AG+21d

Washington State AG+21d · this page

South Carolina State AG+24d

Pattern: first filing Jun 20 (DE), last Jul 14 (SC) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM21004.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2025
Raw hash: d53a8d0370748de067afac7ec6d7a556e68ab9641e0859afb57855d12fdf6993

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHOGAN LOVELLS US LLP

Victim entityAFLAC INCORPORATED

Incidentdiscovered Jun 12, 2025

Stated responseLaunched an immediate response and investigation with support from third-party cybersecurity experts

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com