Aflac

Aflac's initial breach report listed 500 affected people. Aflac's December 2025 update put the figure at approximately 22.65 million - a roughly 45,000-fold revision from the 500-record placeholder, and one of the starkest illustrations in this entire tracker of why an early breach notification number should be treated as a placeholder rather than a fact. The attacker did not exploit a software flaw; they used social engineering against Aflac's own help desk, which is the same technique behind the 2025-26 campaign that swept dozens of other companies documented across these tabs. For the nation's largest supplemental health insurer, the practical lesson for a consumer is uncomfortable: the number in the letter you receive in week one may bear no relationship to the number in the letter you receive in month six, and your decision about whether to freeze credit gets made on the first number.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual policyholder agreements, separate from the 20+ class actions filed after the breach (consolidation/settlement status not re-verified Oct 2026).

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (AFL). Service route: c/o General Counsel / Corporate Secretary, Columbus, Georgia — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.