Aflac Japan: which channel gets the next investment?
Download case PDF (5 pages)Request teacher’s pack
Strategy case for MBA students and working professionals
Decision information cutoff: 3 October 2026, 10:15 a.m. Eastern Time
A service network at a crossroads
By early October 2026, Aflac Japan had restored most of its policyholder website after a June data intrusion. Two online procedures remained unavailable. An agent-assisted online consultation tool had also been suspended, and Aflac had not published a separate restoration status for that tool. The disruption raised a strategic question: where should the company put its next increment of time and investment—into digital recovery and resilience, into relationship-based service through agents and partners, or into a staged combination of the two?
This case presents a classroom decision situation. It does not claim that Aflac announced a specific budget decision or that the company’s leaders were meeting on October 3. The information cutoff is fixed at 10:15 a.m. ET on that date. All facts and company statements below were available by then; subsequent developments are outside the case.
A model built around protection and access
Aflac Incorporated, headquartered in Georgia and listed on the New York Stock Exchange as AFL, operates two insurance reporting segments: Aflac Japan and Aflac U.S. Its principal Japan insurance subsidiary is Aflac Life Insurance Japan Ltd. (ALIJ). Aflac Japan is the company’s principal contributor to consolidated earnings and is a major provider of cancer and medical insurance in Japan, according to the company’s 2025 Form 10-K.[1]
Aflac Japan’s customer relationships extend across human and digital channels. At year-end 2025, the company reported approximately 6,300 sales agencies and approximately 112,000 licensed sales associates employed by those agencies. Its 2025 new annualized premium sales contribution was 47.5% from independent corporate and individual agencies, 49.2% from affiliated corporate agencies, and 3.3% from banks. The affiliated category includes Japan Post Group, Dai-ichi Life and Daido Life.[1]
The company’s distribution relationships do not eliminate the importance of digital tools. Aflac Japan’s “online consultation” system allowed agents and customers to design and apply for insurance remotely using Microsoft Teams or similar software. The policyholder-only “Aflac Yorisou Net” website supported policy review and transactions such as address changes and benefit claims.[2]
The June incident and recovery
Aflac Japan discovered unauthorized access on June 25, 2026, and stopped related systems that day. Its subsequent investigation identified the first access on June 10 and multiple accesses through June 25. The company said the incident affected the online consultation system and Yorisou Net. It reported approximately 4.4 million affected customers, of whom approximately 220,000 had bank-account details among exposed data, plus information related to approximately 40,000 current or former agency contractors. Exposed customer fields included identity, contact, policy and coverage information; bank-account details applied to a subset. Aflac Japan reported that My Number, credit-card details and email addresses were not included.[2]
In its July 31 report, Aflac Japan said controls over the access and data-query methods used in the attack were inadequate. The company said the access looked similar to ordinary use, so it was not detected immediately, and monitoring of rapid bulk queries was insufficient. It described planned controls around authentication and authorization, high-volume query monitoring, security review, penetration testing, and security staffing and oversight.[2] These are the company’s findings and proposed actions; no independent forensic report is included in the case.
On July 1, the company said it received a reporting request from Japan’s Financial Services Agency under the Insurance Business Act and the personal-information protection law. The request sought reporting on incident facts, customer response, cause and recurrence prevention.[3] It was a reporting request; it was not identified as a business-improvement order or fine.
The July 31 report said that, as of that date, the company had found no misuse of leaked information. It also said policyholders could continue submitting claims and other requests through call centers while the affected services were suspended.[2] The company’s October 1 FAQ retained July 31 as the date for its no-misuse statement. That FAQ described the same June incident, not a second intrusion.[4]
On September 28, Aflac Japan announced that Yorisou Net had resumed most services after preventive measures and safety checks. Two procedures remained unavailable online: claims for specified support, celebration and long-term no-accident benefits, and registration or changes of beneficiaries/designated claimants. The company said these requests and inquiries were being handled by call centers; other account-review and transaction services were available.[4] Aflac had named the agent online-consultation system among the suspended systems, but no separate restoration status for that tool was located by the cutoff.[2]
Performance context
The outage overlapped with a period of product activity in Japan. In the second quarter of 2026, Aflac Japan reported new annualized premium sales of ¥19.6 billion, down 5.6% from the prior-year quarter. The company attributed the comparison partly to a high prior-year baseline after the March 2025 launch of Miraito cancer insurance, with strong sales of refreshed Tsumitasu savings-type life insurance and Anshin Palette medical insurance partly offsetting that effect. First-half sales were ¥37.3 billion, up 7.0%. These are sales measured as new annualized premiums, not earned revenue or profit.[5]
Other second-quarter Japan figures, reported in yen, included net earned premiums of ¥245.1 billion, down 3.7%; adjusted net investment income of ¥98.3 billion, down 2.9%; total adjusted revenues of ¥344.6 billion, down 3.6%; and pretax adjusted earnings of ¥118.2 billion, up 3.4% on a reported basis but down 2.1% on a currency-neutral basis. The company cited external reinsurance and limited-pay policies reaching paid-up status as primary reasons for the net-earned-premium decline, and favorable benefits for the reported pretax adjusted earnings increase. Twelve-month rolling premium persistency was 92.7%, compared with 93.7% a year earlier.[5]
These are company-reported segment outcomes, not measures of the incident’s effect. The second-quarter figures do not reveal whether customers changed behavior after the June incident, and they do not isolate the contribution of any channel.
What the evidence can—and cannot—say
Research on breach disclosures and channel behavior provides several possible lenses. Malhotra and Malhotra studied 93 publicly traded U.S. companies reporting customer-information breaches in 2000–2007. Their event study found negative average abnormal stock returns around announcements, including −0.78% over a three-day window; results for the longer window varied by statistical test. This is a market-reaction study, not an estimate of customer losses or direct costs.[6]
Campbell and coauthors studied 43 reported breach events affecting 38 U.S. firms from 1995–2000. The overall three-day return was negative but not statistically significant. Events involving confidential customer or firm information had a more negative average return than events without such access; the sample was small and drawn from major newspaper coverage.[7]
Janakiraman, Lim and Rishika’s abstract describes a difference-in-differences study of a multichannel retailer. It reports reduced spending among breach-affected customers and some shift to unbreached channels, while highly patronizing customers were less negatively affected. The full article was not available in the research record, and the abstract gives no sample size or coefficient. Retail purchasing is not equivalent to insurance renewal, claims service or agent use.[8]
Aflac partner and competitor Dai-ichi Life described its digital app as a way to complement relationships with assigned sales representatives and multi-carrier agencies. That is a company description of its own strategy, not evidence that a particular channel mix earns higher returns.[9]
The decision
Aflac Japan’s strategy team must recommend where to focus the next increment of management attention and investment. The research does not provide an incident-loss estimate, a channel-level sales comparison, the cost of security work, or customer retention data. It also does not establish that agents were unaffected: the agent-mediated online consultation tool was itself among the suspended systems.
Three paths are available for discussion:
- Prioritize digital recovery and resilience. Sequence investment into controls and service validation, then restore and scale policyholder and agent-facing digital tools.
- Prioritize relationship-channel continuity. Rely more heavily on agencies, corporate partners, banks and call centers while limiting the digital footprint until more evidence on service reliability is available.
- Stage a hybrid approach. Maintain human-assisted service while restoring digital tasks in measured releases, with separate readiness gates for policyholder self-service and agent consultation.
Each path has potential service, growth, cost and execution consequences. The available evidence does not identify a single correct answer.
Discussion questions
- What capabilities in Aflac Japan’s channel system create value for customers and the company? Which depend on digital tools?
- How should the team distinguish a security-readiness problem from a commercial-growth problem?
- Which path should receive priority, and what evidence or milestones should govern further investment?
- What data would you ask Aflac Japan to collect over the next two quarters before making a larger commitment?
Source notes
- Aflac Incorporated, 2025 Form 10-K, filed 25 February 2026, accession 0001628280-26-011402, Item 1, printed pp. 2–10, especially pp. 9–10. SEC filing. Agency channel sales are issuer-reported new annualized premium sales contribution, not in-force premium or profit.
- Aflac Life Insurance Japan, “Investigation Results and Recurrence Prevention Measures,” 31 July 2026, pp. 1–4; see pp. 1–2 for event/systems/counts/causes/actions, p. 3 for time-qualified no-misuse statement, and p. 4 footnotes defining online consultation and Yorisou Net. Company PDF.
- Aflac Life Insurance Japan, “Receipt of Reporting Request by the Financial Services Agency,” 1 July 2026, p. 1. Company PDF.
- Aflac Japan, Yorisou Net service status (dated 28 September 2026) and incident FAQ (as of 1 October 2026), service, chronology, cause and response sections. Status page; FAQ. The FAQ preserves July 31 as the no-misuse as-of date and describes the same June incident.
- Aflac Incorporated, Q2 2026 results release, “Aflac Japan Selected Operating Results for the Quarter” table and accompanying Japan narrative. Aflac IR release. Adjusted measures follow Aflac’s definitions; sales are new annualized premiums.
- Arvind Malhotra and Claudia Kubowicz Malhotra, “Evaluating Customer Information Breaches as Service Failures: An Event Study Approach,” Journal of Service Research 14(1) (2011), 44–59, Tables 1–3. DOI.
- Katherine Campbell, Lawrence A. Gordon, Martin P. Loeb and Lei Zhou, “The Economic Cost of Publicly Announced Information Security Breaches: Empirical Evidence from the Stock Market,” Journal of Computer Security 11 (2003), 431–448, especially Tables 1, 4–5. Article.
- Ramkumar Janakiraman, Joon Ho Lim and Rishika Rishika, “The Effect of a Data Breach Announcement on Customer Behavior: Evidence from a Multichannel Retailer,” Journal of Marketing 82(2) (2018), 85–105. DOI. Research access was abstract-only.
- Dai-ichi Life Holdings, Integrated Report 2025, “Initiatives to Improve Customer Experience in Japan,” printed p. 48. Official report.