Aflac's June cyberattack impacted 22.65M individuals

Aflac said in the new update that it has completed a detailed review of the files that may have been affected.

The files included Social Security numbers and medical information, as well as names and contact information.

Aflac began sending notices to individuals affected by the attack in June and is now sending many more notices, now that it knows who was affected, the company said.

"Aflac is not aware of any fraudulent use of personal information as a result of this incident but nonetheless is informing you so that you can take appropriate steps to protect your information," the company says in the new notice, according to a copy of the notice filed with the California attorney general's office.

Aflac is a Columbus, Georgia-based company that sells supplemental insurance products to employers and through worksite marketing programs in the United States. The company also sells cancer insurance and other health insurance products in Japan.

Aflac is offering affected individuals 24 months of credit monitoring, identity theft protection, medical fraud protection and customer support from CyEx Medical Shield. The deadline for signing up for the free CyEx membership is April 18, 2026.

Aflac has also locked the affected accounts, reset the accounts' passwords and added extra monitoring for the accounts, the company said.

Around the time Aflac first announced the breach, other organizations speculated that the attack might be the work of the Scattered Spider ransomware gang.

Aflac has not mentioned the names of any possible attackers in a breach update press release or the new update report.

Lawyers have filed lawsuits in federal court on behalf of many of the individuals affected by the attack, and Judge Clay Land, a judge in the U.S. District Court for the Middle District of Georgia, has consolidated consideration of many of the lawsuits under his jurisdiction.