HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)Government IDHealth (basic)Financial accountCriticalContained

AFLAC INCORPORATED

bd_d73fac9930b96b8a · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 12, 2025

Filed

Jul 14, 2025

To disclose

5 weeks

Affected

363,787state residents only

Linked

6 filings

Confidence

66%

Full breach record for AFLAC INCORPORATED →18 incidents on file

Aflac Incorporated detected a security incident on June 12, 2025, involving unauthorized access to a limited number of systems. An unauthorized actor obtained personal information, including potential health insurance and financial data. The incident was contained within hours. Aflac engaged third-party cybersecurity experts, notified federal law enforcement, locked impacted accounts, and reset passwords. The company is offering 24 months of credit monitoring and identity theft protection to affected individuals. This notice serves as an update to a previous announcement made in June 2025.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 32 days

Jun 12, 2025

Begins

Jun 12, 2025

Discovered

Jul 14, 2025

Filed

vs. sector median

4 wks faster

This filing is one of 6 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Washington State AGbd_2c6b0987aa9123282025-07-11 · +3dVerified
Oregon State AGbd_aca1f25de70724162025-07-11 · +3dVerified
Illinois State AGbd_976e5c43783ad1922025-07-01 · +13dVerified
Delaware State AGbd_914dcca03fa76b502025-06-20 · +24dVerified

Show 1 more filing ↓up to 24d gap

SEC 8-Kbd_b044b84c4e40b4a42025-06-20 · +24dVerified

Name: AFLAC INCORPORATED
norm: aflac
Domain: aflac.com

Name: AFLAC INCORPORATED
norm: aflac
Domain: aflac.com
Industry: Financial Servicesllm

Discovered: Jun 12, 2025
Breach occurred: Jun 12, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 363,787state-resident count only
Data types: PIIIdentity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Launched an immediate response with support from third-party cybersecurity experts
Notified federal law enforcement
Locked accounts identified as impacted
Resetting passwords
Further monitoring for signs of suspicious activity
Changes made: Offering, free of charge, CyEx Medical Shield, which includes credit monitoring, identity theft protection, medical fraud protection, and customer support, for 24 months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Delaware State AGJun 20 · first

SEC 8-KJun 20 · first

Illinois State AG+11d

Washington State AG+21d

Oregon State AG+21d

South Carolina State AG+24d · this page

Pattern: first filing Jun 20 (DE), last Jul 14 (SC) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/2025/Consumer%20Letter%20-%20Aflac.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2025
Raw hash: 3f0412c83d322d213586a175d3dcb7a753fed8a0688dbf1bbc01531a54fe894a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAFLAC INCORPORATED

Victim entityAFLAC INCORPORATED

Incidentdiscovered Jun 12, 2025

Stated responseLaunched an immediate response with support from third-party cybersecurity experts

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov