Aflac Incorporated was the subject of a data breach notification filed with the SC Attorney General. The AG filing was recorded on July 14, 2025.
Data Exposed
Aflac Incorporated was the subject of a data breach notification filed with the SC Attorney General. The AG filing was recorded on July 14, 2025.
Aflac Incorporated is a prominent and globally recognized provider of supplemental health and life insurance, operating at the intersection of the healthcare and financial services sectors. Millions of policyholders rely on the company to provide financial protection during medical emergencies, unexpected illnesses, and periods of recovery. Because of its core business model, Aflac collects, processes, and maintains an immense volume of highly confidential records. This sensitive repository includes detailed health history, policyholder identification credentials, banking information for premium payments and claim disbursements, and vital personal demographics for both individual consumers and employer-sponsored group plans. In 2025, Aflac Incorporated reported a significant cybersecurity incident to the South Carolina Attorney General, bringing the privacy and security practices of the insurance giant under intense legal scrutiny. Within the insurance and financial services industry, security breaches of this magnitude typically involve sophisticated cyberattacks, such as unauthorized intrusions into centralized policyholder databases, vulnerabilities within third-party administrative vendor networks, or targeted ransomware operations. Because insurance carriers maintain vast networks of interconnected systems to process claims and underwrite policies, a single network compromise can expose immense volumes of proprietary and consumer data across multiple operational channels before the intrusion is fully contained. The data compromised in incidents involving insurance providers typically includes full names, dates of birth, Social Security numbers, government-issued identification numbers, active insurance policy numbers, health insurance claim details, and financial account or routing numbers used for automated premium deductions and claim payouts. The exposure of this specific constellation of data points creates profound and immediate risks for affected consumers. Unlike a compromised password that can be easily reset, immutable identifiers like Social Security numbers and detailed health histories cannot be changed. Malicious actors routinely exploit this information to commit synthetic identity theft, open fraudulent lines of credit, file unauthorized medical or insurance claims, and execute targeted phishing schemes designed to drain consumer bank accounts. As a major financial and insurance institution holding sensitive consumer data, Aflac Incorporated is bound by stringent regulatory frameworks, including the Gramm-Leach-Bliley Act (GLBA), state-specific insurance information privacy regulations, and general state data breach notification laws. These statutory and regulatory obligations mandate the implementation of robust administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and security of customer information. The occurrence of a data breach of this scale strongly indicates potential negligence and a systemic failure to maintain adequate security controls, leaving the company vulnerable to legal liability for failing to protect consumer privacy. For policyholders and consumers who received a data breach notification letter from Aflac Incorporated, that document serves as formal legal acknowledgment that your private information was compromised due to corporate security failures. Legally, the receipt of this notice establishes the standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Importantly, affected individuals do not need to prove that they have already suffered direct financial loss or identity theft to seek legal redress; the increased, imminent risk of future harm is sufficient under the law. Our firm is prepared to investigate these claims and evaluate legal options on a contingency fee basis, meaning you pay absolutely nothing out of pocket unless we successfully recover compensation on your behalf.
Based on the data types reported, affected individuals face:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
What the South Carolina data breach notification law and federal statutes entitle you to recover:
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under South Carolina data breach notification law and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
If Aflac Incorporated is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from Aflac Incorporated does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Received a notification letter from Aflac Incorporated?
What it means and what to do next.
Aflac Incorporated breach?
Free case review · No fee unless you win