Aflac Faces Consolidated Class-Action Lawsuit After 22 Million-Record Breach
A federal court in Georgia is overseeing consolidated litigation alleging the insurance giant failed to protect sensitive personal and health data.
Aflac Inc. is facing consolidated class-action litigation in a Georgia federal court following a massive data breach that exposed the private information of millions of customers. The legal proceedings, now consolidated as In re Aflac Inc. Data Breach Litigation, center on allegations that the supplemental insurance provider failed to implement adequate security measures to protect sensitive data.
The breach, which Aflac confirmed occurred in June 2025, impacted approximately 22.65 million people. According to court filings and company disclosures, the incident resulted in the exposure of both Personally Identifiable Information (PII) and Protected Health Information (PHI). The litigation is currently being heard by Judge Clay D. Land in the U.S. District Court for the Middle District of Georgia under Case No. 4:25-cv-00183. While the consolidated matter is the primary vehicle for the claims, the legal action grew from initial filings including Batiste v. Aflac Inc.
The Scale of the Exposure
This incident represents one of the largest data leaks within the insurance sector. The exposure of PHI is particularly critical, as health-related data is subject to stricter regulatory protections than standard consumer information. Policyholders who joined the suit claim that the breach was a foreseeable consequence of company negligence, arguing that Aflac's internal safeguards were insufficient to prevent the unauthorized access of such a vast volume of records.
Industry Implications
The scale of this breach underscores a growing vulnerability in the insurance industry, where the aggregation of medical and financial data makes firms high-value targets for cyberattacks. Because the litigation has been consolidated, the court can now address the claims of millions of affected individuals in a single streamlined process. This consolidation often signals a path toward significant financial settlements, as the sheer number of plaintiffs increases the potential liability for the defendant.
What to Watch
As the case proceeds in the Middle District of Georgia, the discovery phase will likely focus on the specific security failures that allowed the June 2025 breach to occur. Legal observers are watching to see if the court finds that Aflac's security protocols met industry standards or if the company will be held liable for systemic negligence. Further updates are expected as the court determines the scope of damages for the 22.65 million impacted individuals.