aflac.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event for aflac.com, with a high volume of historical data breaches (87,390) and active infostealer logs (6,696) observed over the reporting period. The data suggests a widespread compromise affecting a large number of employee and client credentials, with a notable increase in employee-related events in January 2026 and client-related events in August 2025 and March 2026. The primary malware families associated with these events are Redline, LummaC2, and Rhadamanthys, all known for credential theft. The targeted services include login portals and specific application endpoints, indicating a focus on accessing user accounts. The majority of the exposure originates from the United States, with significant activity also noted in Germany and the Netherlands. The presence of "Combolist sources" and "Database dumps" in leak repositories further confirms the nature of the compromise as credential stuffing and data exfiltration. Given the high volume of data breaches and the prevalence of infostealer malware targeting login portals, this incident poses a critical risk to Aflac's customer trust and data integrity. The extensive historical data breaches suggest a long-term compromise or a large-scale aggregation of previously exposed data. The focus on credential theft via infostealers targeting specific login services like mylogin.aflac.com and phs.aflac.com necessitates immediate investigation into the security of these authentication mechanisms and a review of user account security practices. Prioritization should be given to identifying the root cause of the historical data breaches and strengthening defenses against current infostealer threats, including user education on phishing and credential hygiene.