Aflac data breach: about 22.65 million people, from an intrusion contained within hours in June 2025

How many people were affected by the Aflac data breach?

About 22.65 million, according to Aflac's 2025 Form 10-K. When it first disclosed the breach in June 2025, Aflac said it could not yet give a number. The count came about six months later, when the file review was done.

Source	Who it counts	Number	Date
Aflac Form 10-K, fiscal 2025	All individuals whose personal information was involved	about 22.65 million	Filed February 25, 2026
HHS breach portal	People reported to HHS by Aflac as a health plan	13,924,906	Submitted August 8, 2025
Texas attorney general	Texans	2,055,982	Posted December 22, 2025

The federal health breach portal gives a second, smaller figure. It lists Aflac Incorporated as a health plan with 13,924,906 people affected, in a hacking incident on a network server submitted on August 8, 2025. Neither the portal nor the 10-K explains how the 13,924,906 reported to HHS relate to the 10-K's total of about 22.65 million.

Texas's attorney general lists 2,055,982 Texans, posted on December 22, 2025. The Texas record lists names, addresses, Social Security numbers, driver's license and other government ID numbers, medical and health insurance information, and dates of birth among the types involved.

What happened at Aflac?

Date	Event
June 12, 2025	Aflac identifies unauthorized access to its network; contained within hours, per the company
June 20, 2025	Form 8-K, Item 8.01: no count yet; file review "in its early stages"
December 2025	File review completed; notices to individuals and regulators begin
December 22, 2025	Texas posts its record (2,055,982 Texans)
February 25, 2026	Form 10-K gives the count: about 22.65 million
November 5, 2026	Form 10-Q: no material impact expected; financial impact and insurance coverage still being assessed

The June 2025 8-K says Aflac started its incident response protocols as soon as it found the access. Its business kept running and its systems were not hit by ransomware. Aflac filed under Item 8.01, not Item 1.05, so it did not treat the incident as material at that point. The guide to Item 8.01 versus Item 1.05 explains the difference.

What information was involved?

The 8-K lists claims information, health information, Social Security numbers and other personal information. It covers customers, beneficiaries, employees, agents and other individuals in Aflac's U.S. business. The 10-K later confirms the data was exfiltrated, not just exposed.

Was the Aflac breach material?

Not by Aflac's own assessment so far. The 10-K for 2025 said Aflac did not consider the incident reasonably likely to have a material impact on its financial condition or results. The November 2026 10-Q repeats that view and adds that Aflac is still assessing the financial impact, including how much insurance will cover. The costs it lists include credit monitoring, identity theft protection and Medical Shield for affected people, plus incident response.

What is Aflac offering affected people?

The 8-K said individuals would be offered free credit monitoring and identity theft protection. The 10-K and the latest 10-Q list the services Aflac is paying for: credit monitoring, identity theft protection and Medical Shield, with a call center for them. The enrollment details are in each person's letter. The guide to credit monitoring offers compares such offers.

How many Washington residents were affected by the Aflac breach?

Washington's attorney general lists a report from Aflac Incorporated dated July 11, 2025, with 432,025 Washingtonians affected; the list leaves the breach date blank. It marks names, Social Security numbers, full dates of birth and health insurance policy or ID numbers. That count covers Washington residents only, within the company's total of about 22.65 million.

What the filings leave open

• How the intruder got in.
• How many of the 22.65 million are customers, and how many are employees, agents or beneficiaries.
• What the incident has cost so far, and how much insurance covers.