Aflac Data Breach Lawsuit Indicates Customers’ Private Health Information Was Compromised in Security Hack

Class action lawsuit was brought days after a company email and press release announced the Aflac data breach to the public for the first time.

The insurance provider Aflac faces a new class action lawsuit, alleging that a recent data breach that exposed sensitive health information was a foreseeable result of the company’s failure to safeguard customer information.

The complaint (PDF) was brought by Jessica Batiste in the U.S. District Court for the Middle District of Georgia on June 21, naming Aflac Incorporated as the sole defendant.

Aflac provides supplemental insurance to individuals, helping them pay for additional expenses that may not be covered by traditional insurance providers, such as injuries from accidents, cancer treatments, critical illnesses, hospital stays and other health-related events. 

The company currently serves millions of policyholders across the U.S. and Japan, with more than 50 million people reportedly covered under its plans.

2025 Aflac Data Breach

Despite the company’s vast resources and substantial revenue, Aflac recently announced that it was the victim to a cybersecurity incident, which may have compromised sensitive customer data.

According to a press release issued on June 20, the Aflac data breach was first detected after suspicious activity was found on its U.S. network on June 12, 2025. Aflac says it promptly activated its cyber incident response protocols and stopped the intrusion within hours. The company emphasized that the breach did not involve ransomware and that core business operations, including policy underwriting and claims processing remained unaffected.

While the full extent of the breach is still under investigation, Aflac confirmed that an unauthorized third party gained access to its network using social engineering tactics. Preliminary findings indicate that the compromised files may contain personal data, including claims information, health records and Social Security numbers tied to customers, beneficiaries, employees and agents. Aflac acknowledged that the total number of individuals affected will not be known until the file review is complete.

In response to the data breach, Aflac has engaged third-party cybersecurity experts to assist with its investigation and mitigation efforts. A dedicated call center was launched on June 20 to assist those who may be impacted. As a precaution, Aflac is offering 24 months of free credit monitoring, identity theft protection and Medical Shield coverage to anyone who contacts the call center.

Aflac expressed regret over the incident and pledged continued transparency as the investigation unfolds. The company indicated that it will provide updates to stakeholders as more information becomes available.

Aflac Data Breach Class Action Lawsuit

In a complaint filed the day after the breach was announced, Batiste says that she received an email from Aflac on June 20, informing her that her personal identifying information (PII) and protected health information (PHI) may have been compromised in the Aflac data breach that occurred approximately one week earlier.

The complaint also indicates that Batiste has always been extremely careful with her personal information, and that she is suffering extreme anxiety from the threat of cybercriminals having access to that private data.

In addition, Batiste points out that Aflac failed to follow industry-wide cybersecurity best practices, which potentially resulted in the data breach and compromising of Batiste’s private information, which could lead to identity theft or other adverse consequences.

“As a direct and proximate result of Defendant’s wrongful actions and inaction and the resulting Data Breach, Plaintiff and Class Members have already been harmed by the fraudulent misuse of their Private Information, and have been placed at an imminent, immediate, and continuing increased risk of additional harm from identity theft and identity fraud, requiring them to take the time which they otherwise would have dedicated to other life demands such as work and family in an effort to mitigate both the actual and potential impact of the Data Breach on their lives.”

–Batiste v. Aflac Incorporated

Batiste raises allegations of negligence, negligence per se, breach of implied contract, unjust enrichment and breach of confidence against Aflac. She is seeking certification of class action status for her complaint, as well as equitable, injunctive and declaratory relief for herself and others similarly situated.

Healthcare Data Breach Lawsuits

Batiste’s lawsuit joins a growing number of complaints filed against healthcare companies responsible for massive data breaches that have led to the exposure of millions of Americans’ private data.

According to a report published earlier this year, data breaches involving sensitive health information have surged by 162% over the past 13 years, rising from 216 incidents in 2010 to 566 in 2024, with an estimated 170 million people impacted by healthcare data breaches last year alone.

More than half of those individuals affected by healthcare data breaches, were victims of a Change Healthcare data breach, which occurred in February of last year, and has led to numerous Change Healthcare lawsuits being brought against the company.

Change Healthcare operates as part of Optum, which is a subsidiary of UnitedHealth Group. The company provides a wide range of services used by tens of thousands of healthcare providers, hospitals, pharmacies and insurers to verify insurance, confirm pre-authorization of procedures or services, exchange insurance claim data, and perform other administrative tasks essential for the delivery of healthcare.

The company’s February 2024 data breach affected the healthcare data of as many as 100 million individuals, leading many to seek restitution for their financial and emotional suffering through a series of lawsuits filed against the company.

Sign up to receive more legal news that may impact you or your family.